Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. I wanted to make a video on my updated email setup. For years I was using Proton and Tuda, but at this point I have migrated all my domains to a self-hosted instance of Stalwart. I want to start off by giving some background on this decision and then some of the pros and cons of it. So while I have my complaints about both Proton and Tuda, in general I think they both provide a great service. It’s also worth understanding my outlook on email is that it’s not private at all. You’re using one unique identifier to contact another unique identifier. Yes, you can use PGP to encrypt the body of the message and sometimes the subject. You can also use things like aliases or simple login, which can improve your privacy a bit, but that also comes with its own complications. Like now you are stuck paying for a service since you don’t have control over those aliases, which I got to give props to Proton on purchasing simple login. It makes it much more difficult to leave their service if you use that alias feature. So if you… Even with my view on the privacy of email communication, there still is a massive benefit to using an end-to-end encrypted provider like Tuda or Proton. If you use one of the big centralized providers like Gmail or Yahoo, all your emails are stored in the clear on their servers. They can scrape those emails for information and at this point use them to train their AI models. So while that does help protect your emails that are stored in your inbox, it doesn’t help for the emails you send to anyone using Gmail or one of those other providers, but that’s a whole separate topic. Typically when you self-host, it’s for a privacy benefit, but with something like Stalwart, if I’m being honest, I think it’s actually less private to self-host my mail server. If you look at my sideofburritos.com domain right now, you’ll see the MX record points to mail.sideofburritos.com. And if you look at that, you’ll see it’s tied to a Hetzner IP address, so you know the IP of the VPS that I’m using. I’m the only one using this mail server, so all the activities… originates to me. If I’m using something like Proton or Tuda, my activity can blend into the masses, but that’s not happening in this case. But for me, it’s more about control and having visibility into my email versus that small, in my opinion, privacy benefit. One example of this that kind of pushed me over the edge to finally set this up. I was having some issues on Tuda receiving emails. Randomly, I had an email that was getting rejected that was previously working. I checked the rejected tab in the Tuda app, and I didn’t see anything listed there. I asked their support about it, and they said, not all rejections are visible there as it depends on some criteria. It can make a difference, for example, whether the email was rejected due to an issue with the email itself that caused the rejection, or if the sending server is blacklisted. We can always reach out to the service if there is a general issue with email communications with our server. So the email that was getting dropped was an email from my membership site. I have mailgun configured as the smtp sending relay on there, so I checked the logs on there. Everything looked like it should have been delivered. Malgun showed no issues with the sending of the email, so tuta was just dropping it for some reason. I never really got an answer on why those were getting silently dropped, but like I mentioned earlier, that for me that was kind of the breaking point for wanting more visibility into my email instead of this sort of black box set up. And I’m not specifically blaming them. I can only imagine the amount of phishing and spam emails they need to filter out, especially offering free accounts. Who knows what kind of traffic they’re getting? But what I really wanted was more visibility, so if something was happening I could dig into it and figure out why. So with stalwart I finished migrating all my domains about two months ago, which I think is a decent amount of time to test it out, and in that time I haven’t had any issues with it sending or receiving emails. I’ve updated it a few times and all the updates have gone successfully. No issues. Let me put this in dark mode quick. So some of the pros with Stalwart, since you are self-hosting it yourself, you can host as many domains as you want on there. With Proton, I think the plan I had, I was limited to three, so I needed to use aliases for some domains and shared domains for emails. I couldn’t give every domain its own email, so that was kind of an inconvenience. Stalwart also supports server-side encryption using OpenPGP. So the cool thing about this, Proton actually uses PGP for their encryption, some rendition of it. But if you use a client like Thunderbird, which is what I use because it’s the only one I found so far that supports using PGP for opening your emails on desktop and mobile, you can actually discover the published Proton PGP keys for the emails. They publish those by default when you sign up. So if I’m emailing someone at Proton.me, I click discover in Thunderbird, it finds their published public PGP key, and now those emails are intent-encrypted. So I don’t actually need a Proton account to email someone using Proton encrypted. So that’s pretty great. And on the topic of security, Stalwart reminds me of Graphene OS in the sense that out of the box, the default setup is pretty secure. You don’t have to worry about being an open relay just because you set it up. In the past, when I used to self-host my own email server, this was about a decade ago at this point, most of those services available at the time were configured to be open by default. So you had to make sure you locked them down, didn’t miss anything. Otherwise, you could be an open relay and now you’re sending spam mail because someone found your server when they were scanning the internet. With Stalwart, it handles MTA-STS, TLS provisioning, DKIM key generation, rotation, and DNS publication. All of that is handled automatically if you use their DNS integration. I’m currently using it with Cloudflare and Bunny.net. Both have been working flawlessly. It also has… automatic IP banning, rate limiting, ACLs. So if someone’s scanning your server and they trigger that rate limit, that IP is automatically blocked. So this next part is going to get a bit into the weeds on how email works. But if you’re at all curious about this, it’s going to be worth watching. Otherwise, you can just skip ahead to the cons section of this video. So I currently host my stalwart server on Hetzner. And by default, they block ports 25 and 465. This is common on VPS providers. Spammers will sign up quick and start spamming from their IP addresses using a VPS, which can cause a bunch of IPs to get block listed. So by default, they block that. If you’ve been paying for a month or a few months with a VPS using Hetzner, you can request those ports to be unblocked. I did it and it was unblocked within seconds. I think it was automated. But as far as sending goes, I actually use a SMTP relay. In this case, SMTP to go. The reason for that is is while I do plan to have that Hetzner VPS long term, I don’t want to be responsible for the IP reputation of that. If an IP gets marked as spam or block listed, now people will stop receiving your emails because of the IP reputation. It’s not something I want to worry about. If I had my own AS and my own IP range assigned to me, which would be way more long term that setup than I would send from my IP range. But in this case, I don’t. But that would be a fun future project. SMTP2Go, their free plan offers 1000 emails per month. That doesn’t count against receiving emails. That’s just sending. I can’t imagine more people, at least an individual, send more than 1000 emails per month. So the free plan should work for you. That’s what I use. So far, it’s been great. I haven’t encountered any sending reliability issues. There’s also a bunch of other free relays out there you can use. I think Postmark has 100 emails per month. Mail gun has a thousand they allow, so there’s definitely options, but that’s what I use for sending. Again, I don’t want to worry about the IP reputation of my vps, so I use a third party for the sending. But getting back to some of the other things that stalwart offers, they do have a masked email option. You’ll notice this is marked as an enterprise feature, which I’ll talk about in a few minutes. So I believe this is similar to something like simple login. Each mask is bound to one account and can be disabled or destroyed independently, so end users can hand out different addresses to every external service and cut them off without affecting the others. I really do like simple login as a service. It’s easy to use, provides a nice privacy benefit, but it’s kind of like the mafia. It’s really easy to get into it, but good luck migrating away from it. So I’m hoping to move to something like this using a separate domain specifically for aliases, but we’ll see how that goes. One other pro regarding stalwart is mozilla who offers thunderbird. They’re going to be offering thunder mail in the future, which is a paid hosted version for email. You can join their waitlist if you want, but they have a blog post where they mention that the only project we’re using to help build thunderbird pro is stalwart, but we absolutely want to make sure the project gets its financial support from us to support its sustainability and well-being. To me, that’s a huge benefit to using stalwart. There’s going to be a large company behind it supporting it financially, and I think that speaks a lot to the longevity of the project. Now getting to some of the cons of stalwart. As we saw on the masked email wiki page, it’s marked as an enterprise feature. So if we go to stalwart pricing, the minimum you can pay for is 25 mailboxes, which comes out to 60 usd per year. I actually think that’s cheaper than my proton plan currently that I have. I pay for it. To me, that’s more than worth it to support the open source project and get some of the other features that are behind that payment. And then regarding the privacy and pgp keys, so proton and tuta, well actually I don’t know what tuta uses exactly, but with proton they automate that entire pgp key setup. With stalwart you’ll have to generate those keys yourself, configure them. It’s not difficult, but it does take some time to set up. And like I mentioned earlier, the only clients I found so far that support that encrypted mailbox are thunderbird. I couldn’t find any web clients that supported it, which is unfortunate. I think I saw something that stalwart might offer a first party webmail client and hopefully it’s supported in there. I would like to have webmail accessible. So you are limited on the clients you can use. You’ll have to use the app thunderbird desktop and mobile if you want that. Stalwart does have built-in spam spam filtering, but it’s overly aggressive. You… there is a feature where you can submit the mail and say this is not spam to kind of teach the filter. I don’t know if I just don’t receive enough mail or I haven’t done that enough, but it hasn’t really seemed to help. But I do guess it’s better that it’s overly aggressive versus not being good enough, so I just make it a habit to check the spam folder every so often. I have also configured a few sieve rules to allow list domains and senders to make sure those don’t get marked as spam. So again, kind of goes back to that self-hosting setup. There might be some things you need to tune yourself. It’s also worth mentioning that stalwart is currently pre-version one. They expect the version one released in the first half of 2026. It’s currently the second half, so I’m assuming it’ll be next year in 2027 because at this point there’s not, there is no stable or finalized database schema and configuration system. So when you are doing upgrades, there might be some breaking changes you’ll have to handle yourself since you are self-hosting. If that doesn’t sound like something you want to do, then you might want to put this off till version one. Like I said, though, I started doing this about three months ago or two months ago. All the upgrades so far, there’s a new version every week, have been straightforward and simple. Docker pull and Docker up, and the new version was deployed. So those are the cons that I found so far regarding stalwart directly. These next cons are more self-hosting in general related. If something happens with your email setup, there’s no status page to check. There’s no email support to contact. It’s on you to resolve. If you’re not receiving emails, you’re wondering what’s going on. Again, that’s on you. You need to check the logs, see what’s going on. Did you hit your limit in your SMTP relay? Did your ports somehow get blocked? Did Docker stop running? Did the process crash? In my experience self-hosting, these things aren’t common, but when they do happen, they can take some time to figure out. I really do think that self-hosting is easy, especially with docker. A couple commands, you can have a service running setup and you can start using it. The part that’s not easy, which I think a lot of people don’t think about when they’re paying for a cloud service, is consistent reliable backups. It’s easy to set a service up, but if that hard drive dies, you know, even if you’re using a shared hosting provider, they do have hardware issues. If that server dies and they just give you a new one with a fresh installation of your operating system, can you restore your backups? Do your backups run reliably every day? Do you monitor those backups? Do you check them for freshness? Do you document your restore procedure? Different things like that that people don’t talk about enough because they’re not that interesting to share because you only need them in a worst case scenario. But if you are self-hosting, you really need to think about those and take that into consideration before you decide to dive in head first. So is the juice worth the squeeze? I don’t know. That’s up to you. To me it is. I also just enjoy doing this kind of stuff. If you’re going to be annoyed when you get an alert on the weekend in the middle of the day when you’re hanging out with some friends and you’re now no longer receiving email, then doing something like this probably isn’t for you. Stick to a managed provider. But if you’re at all interested in self-hosting email, I definitely recommend checking out stalwart. I’m also thinking about doing a full setup video with another domain that I have that I don’t currently have set up to receive email. If you think that’d be useful, let me know down in the comments or in the comments on my blog, and if there’s enough of those I’ll try to make that video happen. But that’s all I got for this video. I hope you have a great rest of your day and I’ll see you next time.Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. So today what I want to talk about is the case of United States versus Tunick. This is regarding the use of the duress pin on Graphene OS. I thought we could start off by just reading the official indictment against Tunick before covering some other nuances in this case. So on or about January 24th, 2025, in the Northern District of Georgia, the defendant Samuel Tunick, before and during the search for and seizure of property by Customs and Border Patrol Tactical Terrorism Response Team, Supervisory Officer L.CDOT, a person authorized to make such search and seizure, did knowingly destroy, damage, waste, dispose of, and otherwise take any action to delete the digital contents of a Google Pixel cellular phone for the purpose of preventing and impairing the government’s lawful authority to take said property into its custody and control in violation of Title 18, United States Code, Section 2232A. So the first thing I want to say about this is regarding the knowingly destroy, damage, waste of, dispose, delete digital contents part. The way the duress pin works on Graphene OS is when you enter that pin, it initiates the sequence, which deletes the keys that are used to decrypt the data on the device. Those keys are used to decrypt the data on your device when you correctly enter the pin and they’re stored on the secure element. So it’s the keys that were deleted on the device, not the actual data. For all intents and purposes, that data is now permanently inaccessible, but the data was not actually deleted. Again, like I said, this is a very nuanced point, but the law loves nuances. I was trying to think of a good analogy for this. So imagine the lock you have on your house. You insert the key, you open the lock, you can access your home’s contents. Entering the duress pin is equivalent to changing the pins on the tumbler inside the lock on the door. So now when you insert the key into the lock, the key no longer works because the pins have changed. At that point you can’t access your home, but everything inside is just as you left it. It’s just the key no longer works. I’m not a lawyer, but that doesn’t sound like it was destroyed. I guess we’ll see how that plays out. So that’s the initial indictment. I’ll link this down below if you want to keep up with the court case. The latest item was released on July 20th, 2026. But at this point there’s been a bunch of articles published on this topic, and the first one I want to talk about is one from Ars Technica. So in early 2025, like we saw in the initial indictment, Atlanta resident Samuel Tunick was on his way home following a trip abroad. After landing in the U.S., customs agents demanded access to his Pixel phone, which was running an alternative version of Android called Graphene OS. And rather than handing over his data, Tunick used a clever feature of the software to delete everything, which again is the duress pin. He actually told the border patrol agents his duress pin, they entered it, and the data was erased. During their interrogation, CBP agents told Tunick they wanted to search his phone for evidence of child sexual abuse, and if he didn’t unlock the device, it would be confiscated. Unless you are the Catholic priest from the town where I grew up who was charged and convicted of possession of CSAMβyou know what they say, it’s always the ones you most suspectβthen these types of searches for everyday individuals are usually just fishing expeditions. It’s an excuse to protect the children, like we’ve heard dozens of times, and the thing that kind of backs that up is this is what CBP told him, but it turns out it’s because he was part of a group called Defend the Atlanta Forest, which opposed the construction of an enormous law enforcement training facility in the area, often known as Cop City. So this is what actually landed him on a list and got him detained at the airport. But it just kind of makes me laugh that they followed the typical procedure of accusing someone of possessing CSAM, and that’s why they’re doing the search, and in order to protect the children, please unlock your device. Tunick also claims he was never read his rights and requested legal counsel several times, but the requests were denied. He was at a border area. He was re-entering the U.S., and a lot of rights are sort of in a legal gray zone at that point, which is why they can conduct these warrantless search and seizures. The other article which has some great points is one from 404 Media. If you haven’t heard of them before, check them out. They put out some really good content. The agents tried to rig this game by making this all come to a head at the airport, he added. Ordinarily, authorities would need a warrant to search the contents of someone’s phone, but at an airport, those protections often do not apply. They could have asked a judge for a search warrant for Sam’s phone if they thought they had evidence for a crime. They didn’t do that. CBP said all travelers are subject to inspection and ensure compliance with the U.S. laws. These inspections, including questioning and rare search of electronic devices, are conducted on a case-by-case basis, taking into account factors such as travel history and law enforcement alerts. And speaking of those alerts, Department of Homeland Security, also known as DHS, called the airport ahead, said Tunick was coming through, and asked officers to stop him. βWe want you to get his phone and search his phone,β the officers said. So a lot of this keeps going back to Graphene OS, the use of the duress pin, which I think is great. It’s a fantastic feature. I think it’s also worth remembering that the reason Tunick is in this situation is because he legally participated in a protest, which happened to land him on a list that got him stopped at the airport. So while some protests will get you on a list that gets you detained, other protests, at least I think it was a protest, will get you a presidential pardon. Regardless, if you’re in the United States, I think this video from the Pot Brothers at Law has some really good advice if you are detained. And they ask more questions? Am I being detained or am I free to go? And if detained, what do you say? I invoke the fifth. And then what do you do? You shut the fuck up. Now, whether or not you should enter the duress pin if you are detained, I guess we’ll see how this case goes and see if it is a legal thing to do. Again, if you want to keep up with the case, I will link this down below so you can check for updates. I do think this is one of the most important cases when it comes to privacy in recent years. So I’m extremely curious to see how this goes. When there are updates, I will make some future videos on it. But until then, hope you have a great rest of your day, and I’ll see you next time.Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. Okay, looks like we’re good to go. Again, welcome, everyone. Today I’m joined by spring-onion from the GrapheneOS team, and we’ll be taking your questions, kind of going through things. We don’t really have much of a format for the chat, but let’s see how it goes. Um, yeah. Hello, everyone. Here I am. My name is spring-onion. I am the community manager for the GrapheneOS project, and if you have been following the project close-ish, chances are you will have seen my name around. I’ve done some things in the past. Either that, or maybe you also know me from my pseudonym, Dave Wilson. So, hello, everyone. Excited to meet you on a more personal note, perhaps. Yeah, definitely appreciate you coming on, and I’m excited to see how this goes. If anyone has questions, post them in any of the chats, and we’ll try to get to them and see how it goes. Let’s see. Just taking care of the self-hosted stream quickly and changing some settings. Okay, let’s stop this one quickly. Okay, now we’re good. Reading some pretty, pretty nice comments. Ready? Okay, I think we should be good. One question I saw, I guess I’ll throw this one out quickly. Someone else actually asked me this too: Any further news on the Motorola phone, or any updates on that? It’s funny because it’s something I thought about before the livestream. I was wondering when that question was going to show up. Apparently, it’s the very first one, so that’s pretty funny. Not much I can say in that regard. It’s going well. That’s what I can say. Things are going as planned, as per plan. So, yeah, all good on that front, but not much more I can really share beyond what’s been shared so far by the press release and what you can find on our socials and whatnot. Yeah, I figured it was kind of hush-hush at this point. There are many things that are not really set in stone yet, many things that might change over time, et cetera. But rest assured, everything is going great. So, yeah, we’re on track. Good to hear. Okay, yeah, it’s something that we didn’t actually touch on initially. The plan is that, Josh, you look over the stream chats, and I check our community chats. Remember, you can ask your question on the stream as well as in the chats on our Discord and Matrix. If you use the chats, please do so in the media channel. Because these are the only ones I’m watching. All right, let’s see. There’s a question here, how long have I been the community manager? Not that long. I honestly, I cannot really give you a definite date because it kind of just came along. Yeah, it kind of just came along over time. So I can’t really give you a definite date. But for a couple of months now. Yeah. Maybe about September last year, but you know, you didn’t hear too much about me until rather recently. Oh, sorry. About that I need to I forgot to to mute my phone there rookie mistake here’s a question I got is there a way for the apps not to see tun0 interface when they are excluded from the VPN tunnel um interesting question I’ll be honest that is about my pay grade um I suggest you ask in our general chats um. That is above my pay grade I’m sure just in general we have a lovely community and someone’s always around to hopefully hopefully answer that question yeah the forum’s a great spot for that stuff yeah that too let’s see is everything oh here’s a good one this is kind of a hot topic is everything we’re hearing about Google locking down installing apps outside of Google Play Store going to affect GrapheneOS in any way? And what are your thoughts on this for the Android community in general? Great question, because that is actually one of those topics I’ve wanted to touch on a little deeper. So there is a site, it’s called keepandroidopen.org, right? Pretty catchy name, I like it. We did sign the petition, okay? We did sign it because we like the general idea on what keepandroidopen is trying to achieve, right? What it’s trying to achieve is to bring attention to Google, bring attention to AOSP, bring attention to what is happening with AOSP, what Google is doing. And as of right now, keepandroidopen is solely focused on the upcoming developer, like Android developer verification. But it’s settled. To rule out rollout relatively soon I think it was september originally I’m not sure the date has changed um the problem is just um you see it’s it’s complicated because um Keep Android Open is a little alarmist sounding okay if you go open the web page right now uh it’s gonna tell you hey Android is being locked down in x amount of days um and Google is gonna like block side loading and it all sounds very alarmist um and maybe not entirely accurate because you see what’s happening is that yes Google is restricting side loading um in the future however they’re not blocking it entirely okay um the biggest hurdle they put in place is that you as the end user have to wait 24 hours to install an app by a developer that didn’t verify themselves to Google. That is a one-time process. And well, okay, you do also have to click through a bunch of warnings, but the 24-hour wait, that is like the biggest hurdle you need to overcome. And that’s really it, right? But Keep Android Open. I mean, it does say that like further down in the line, further down the website, sorry. It tells you what Google has planned and how to, I suppose, reactivate normal side-loading behavior. But we, as a project, like as a whole, we have seen a lot of people on the internet who seemingly don’t quite like fully understand the implications and like what is actually happening with with this program and that is a problem right because people might feel inclined to. Drop Android they might feel inclined to switch to Apple um and that is a big problem so um we we are currently talking with the Keep Android Open folks and uh suggesting them they should perhaps um update the site a little to um better better accommodate the the reader in a sense. I guess along those same lines the age verification that some states or places are looking to put into effect will that come into play on GrapheneOS at all or no no no No, we will just not implement any of that. It doesn’t really affect us in a sense. Though we will just not, as far as I’m aware, not much can really happen to us. So we should be covered there. But to go back to Keep Android Open, you see, from my perspective, if the reader or the customer in that sense reads your website and comes to a conclusion, a conclusion they shouldn’t come, then I would argue it’s kind of your responsibility to make sure to kind of rephrase your wording so people do get the overall gist right. So hopefully that is something we can work together on to maybe… Fix in a way because it is a real problem um people are very scared about this Android developer verification and like yes you you should definitely talk about it you should educate people um but we need to educate people right okay so people know what’s coming so they can react appropriately um and most importantly not decide wrongly right we don’t want people to jump ship to to Apple okay when that’s really not necessary um so yeah because another another thing what at least I personally kind of envision for Keep Android Open is that it becomes sort of a hub of like central location um central like information that you can inquire about like the current state of Android or AOSP. So it can perhaps talk about some of the other issues that have been, you know, plaguing AOSP as a whole, like the Play Integrity API, right? Play Integrity API is a topic that is significantly worse than the current Android developer verification. So hopefully, we can work together to essentially add to the, to the website and improve on things. But I have a good feeling, as I said, we are, we are talking with them and, um, yeah, hopefully we can, we can figure it out. Do you want to grab a question from the Discord, if there’s any over there? Cool. So, let’s go. All right, let’s see. Where are you from, Mr. Onion? I live in Germany. And I also speak German fluently. That was a short one, so maybe I’ll grab another one. What are the current plans regarding localization? Translation of the OS apps and language support for future keyboard rework slash replacement. So localization is something that we have been looking into. This is also another topic where people often come in the chat rooms and suggest, hey, why do you not just accept translations from other people, right? Like a crowd-sourced… Crowdsourced… Translation and it it sounds good on paper on first glance um the problem is just that if we add a language okay then we need to support that language moving forward okay what does supporting language mean if text gets changed with the next update that text needs to be updated as well like immediately okay and so this whole procedure cannot really um stop the update from coming out so every needs to be in sync in a way and done very quickly so that is always something to consider and the the approach of this crowdsource approach of translations carries a risk um I suggest you look into what happened with Ubuntu uh you couple of years back when I believe it was their installer who the like their installer featured hate speech temporarily so that is obviously not good and something we absolutely want to avoid as for what like languages would be supported first. I would assume that German is pretty high up there but yeah it is it is definitely something we want to do but with with everything we do really we want to do that with a lot of care. So in a sense it is on the to-do list. So next one my whole family and friends use WhatsApp what would you use on GrapheneOS would you just install it or use another device and I think there’s also been some issues lately registering for new one WhatsApp accounts. So I guess any thoughts on that? Yeah. To kind of answer the first part of the question, I mean, the de facto standard is Signal, I guess, among the privacy community. If you’re talking with your family primarily, I think you’re going to have a better time having them switch to Signal, right, if possible. But don’t fret. Don’t fret to install WhatsApp on GrapheneOS if it comes to that. That is something that a lot of people get wrong. They think, hey, there’s this awesome OS and it’s super privacy focused. And that means I’m not allowed or I do something wrong if I install an app like WhatsApp or even Facebook, like Instagram, all these apps that are not exactly perceived as privacy. Respecting. But you couldn’t be more wrong in that regard. Because like we have, you know, Gryphoner has many features to deal with these kind of apps that are somewhat harmful to your privacy, right? Like contact scopes, for example, in regards to WhatsApp. I believe that WhatsApp will ask for your contacts, you can use contact scopes to limit the access of your contacts to WhatsApp, you can either give it no contacts, or maybe some select, some select contacts if you want. So yeah, if you know, if you’re gonna run privacy harmful apps, do it on GrapheneOS. Because that is the very best place to run them. Yeah, as for the WhatsApp problem. That is something I have noticed in the community I believe that WhatsApp might be looking for like basic play integrity you can achieve that on graph in os but you need to so you need to install WhatsApp from the Google Play Store and you need to be logged in the Play Store if you fulfill these two requirements WhatsApp should work I would assume but that is also another another case where perhaps you should consider inquiring the the chat rooms in the forum um maybe maybe somebody else has another tip they can share yeah I think things are just a little bit tougher in that regard even creating new Google accounts has been more than a hassle in the recent months so I don’t know if that’s part of it got a bunch of questions here but if you want to grab one now there’s so many questions yeah I’m just trying to I feel like I’m kind of you know sorry I’m kind of maybe rambling a little too long I’m still kind of easing my way uh into this into the stream uh let’s see I’m going to try to grab one from Matrix um let’s have a look um satire question for downtime do you eat spring onions absolutely spring onions are an amazing garnish and I always have some at home and I would definitely recommend you to also have some so um yep definitely thumbs up from me um okay next up those graffinos have any potential plans for services to run alongside GrapheneOS to enhance out of the flash usability and also get an. Additional steady stream of revenue maybe an Android app privacy audit service encrypt encrypted backup service etc um so to answer the out of box experience we are currently reworking like the default apps um to kind of you know modernize them because you know admittedly you know the the aosb apps that come pre-installed are not exactly super modern so we’re currently uh modernizing those I believe that the messaging app so the SMS app is about to be released um so for the SMS app I believe there is still some work to be done um kind of in the background on a technical side of things but the ui modernization is pretty much done and I think you can expect that to be released this month in july I would believe that the gallery app is the next in the list um as far as I know a lot of progress has been done on that front hmm but that is not so confirmed just yet but yeah we are working with it as for um your main question uh any other kind of service to run it depends really I mean we are a non-profit you know we run entirely by donations um Android app privacy audit service no I don’t think we’d really be interested in that too much um because you know some people might consider WhatsApp to be fine to use other people will not install that no matter what encrypted backup service I mean there’s a backup solution already in place it is local admittedly I mean if if we were to run like these kind of services will be paid I mean we’d most likely develop them ourselves and. Uh that is again something that needs to be done with with great care. I I wouldn’t I wouldn’t completely rule it out but uh not at the moment no this one’s regarding GrapheneOS development are llms used in development of GrapheneOS in any way whether it be for code generation code review etc. Um I know that some of our developers have been using like ai effectively you You know, obviously, they use it in specific circumstances, and they don’t just bytecode the OS. But like, that’s, that’s the difference, right, AI can be a tool. But you need to know how to use the tool. And I’m sure that our developers know how to, how to use LLMs and AI in a broader term, to maybe accelerate development or even research, while, you know, not really compromising the security of GrapheneOS, essentially, you know, of course, we make sure that the quality of GrapheneOS isn’t, isn’t going down the drain. Yeah, there’s definitely a lot of a spectrum of AI use when it comes to code. Mm hmm. There’s some pretty bad stuff. And then there’s. Some you know there’s always the defense like oh ai hallucinates which for sure it does but also developers make mistakes there’s yeah yeah it’s a big answer I think it’s it’s really difficult for me to to like give a solid opinion about that because you know I’m not a developer myself and it also just ai on its own kind of keeps progressing it’s also worth noting that the devs also review each other’s work right so that happens all the time and of course we also note when when something has been made by ai but every everything’s being reviewed by an actual human so there is no actual like vibe coding happening here we don’t do that here. Okay you Um, any plans to change the default search engine to start page or quant or even karma search? Um, I, I, I’m not aware of any such plans, you know, it’s something we might revisit in the future, but at the moment, I think, uh, we’re, we’re pretty okay with DuckDuckGo. So on the topic of browsers, um, question, when will Vanadium be available for other Android phones? Is there any plans for that or in the works? Um, well, the thing is we develop Vanadium for GrapheneOS, right? So a lot of the work goes to support GrapheneOS exclusively. Um, I believe you can already run Vanadium on a non GrapheneOS Android. So, um, yeah. But it’s not something we’re going to test I cannot give you a timeline for that it is something we might release in the future but I I wouldn’t bet on it anytime like soon like very soon like very near near future I wouldn’t I wouldn’t bet on it yes there’s also a lot of a lot of things we we want to do for Vanadium no features so all right let’s see. Someone commented this month new SMS app awesome um I mean yes like that is my current status um but yeah don’t please don’t quote me on that if it doesn’t happen okay I I’m pretty I’m pretty confident um that it will but at the end of the day um things can change very quickly right like um the devs might be working on it on a specific feature you uh on a specific part of the os but then something might come in some kind of bug and then everything needs to be dropped and we need to handle handle a bug or whatever so um but yeah it’s it’s looking good on that front for sure um I want to get another question because I really just commented on a on a comment there I’ve heard that graphene needs more developers is graphene a good project to get started in phone software development and if so how to get started with little knowledge about general development um interesting question um I I would say that graphene was isn’t exactly a junior dev kind of project So I suggest you should definitely brush up on your development skills first. But for sure, it is a great place for inspiration. And just maybe you can get a good idea or a good overview on how we run things that might give you some inspiration, especially on the security side of things. I mean, everything is open source, right? So you can poke around. You can also ask the devs themselves if you want. They’re also around often. A quick note, maybe, Josh, before you read out the next question. I’m sure we’ll be missing a lot of questions. Guys, feel free to repose your questions every now and then. Just don’t overdo it, okay? But I think repose are okay. Yeah. That’s that’s all from from my side are there any here’s one are there any huge security functionalities coming down in the future similar to something like hardened malloc. I am not aware that there’s any like groundbreaking features in that regard coming um I believe like harden the hardened memory allocator is just something that you also kind of maintain over time I mean in most recent times there was memory tagging right which we kind of set up um as the first like kind of production ready state um so we’re pretty proud of that memory tagging incredible feature um also one of the primary reasons we recommend the Pixel 8 and above and I’m assuming that’s probably going to be some of the requirements for the Motorola device yeah yeah exactly you see that is also why um the upcoming Motorola phones are premium models because um you know Tensor has had MT for a few generations now but Snapdragon has not so for like on the Snapdragon side of things it’s a very new development in a way and it’s one of those cases where it needs to kind of trickle down first that’s why it’s it’s really only available in like the latest and greatest Snapdragon chip which is good on the one hand because it’s also very um performant right especially in comparison to the Tensor chip but the downside is that it’s obviously a premium model which means it’s gonna be expensive. Okay, let’s see. Will the GrapheneOS team members use Motorola devices as their main phone or still use Pixels? That is a good question. I think that is a very kind of personal matter. I’m not really sure, to be honest. It really depends on what people prefer. But also, at the end of the day, these upcoming Motorola phones will be flagships, right? So I don’t think there will be much to hate on, in a way, if you understand where I’m coming from. I think this one, I always see this come up from time to time in the forums. But what about IPC scopes? Is there any progress on that or any complications that have come up? Mm-hmm. Yes, so IPC scopes, definitely something that a lot of people are looking forward to. And it’s also something that we said we’re going to do in the past. But the truth is, it’s a very, very difficult feature to implement, right? Because the fun of this feature would be to stop any kind of side channel communication, any kind of leaks from happening. And making sure that nothing is leaking, making sure it’s actually bulletproof is very difficult. So it remains to be seen if we will move forward with this feature. Because at the same time, you also have the private space, which is essentially a secondary profile. That is just kind of a little, just a little bit more convenient to use. And so… Yeah. You can also make the argument hey maybe we should focus our work on private space make sure you know you can use multiple maybe in the same profile. So yeah it it remains to be seen but is it is very difficult to to implement right because you see we we don’t we don’t do like half baked features okay like if we release something it’s because we are we’re confident that it it works and it works well and it also has a point right because um we get a lot of like feature requests um of people who who have ideas but then if you actually look into it and really like sit down think about think about the feature think about uh you know what what is the purpose of this feature um what could defeat the feature in a way and then you you kind of come to the conclusion that maybe you So many features out there aren’t actually as great as they sound like at first. And I think when you look into a feature, it might seem simple at first, but there’s a lot that goes into it. And if something’s released and it seems like it was simple, I feel like that means it was just more work. Because there’s some things I see in apps where they just bolt on functionality that anyone asks for. And before you know it, you just have a bunch of complex options and something that don’t really make sense and aren’t really maintainable. Yeah, we are very selective in what kind of features we add to GrapheneOS. Because A, you have the initial workload of actually implementing the feature. Well, the workload doesn’t only consist of implementing a feature. Because as I said before, you need to design the feature. You need to think it through, what is it for, how could it be defeated? Passes that stage then you know I suppose we give it a priority um how how big of an impact would this feature bring um and then decide from there but it doesn’t end there right like just because you you add a feature like for example duress PIN password okay that is something that a lot of people ask for it’s it’s it’s out there right pretty proud of that feature but anytime a new version of Android comes out we need to port the rest PIN and in fact we need to port everything right so every feature that you add comes with this kind of hidden maintenance cost that you need to consider and so over time as like feature set of GrapheneOS grows the the actual burden of work also increases and that is something you need to be very very wary of um so yeah. Here’s an interesting one GrapheneOS has been disappointed in the changes to the Android release cycle and security patches approach from Google do they talk about this with Motorola are they on the same page and might they help you lobby for changes maybe in cooperation with other OEMs that might agree with your criticism um. I can say to that that um we are very happy to have Motorola as a as a partner right I mean it’s a it’s a pretty strong player in the field um so that’s that’s always nice to have but I’m afraid I cannot give you any detailed information so So it’s all about that, but I cannot answer that sufficiently, I’m afraid. While we’re on the topic of Motorola, for the new device coming out, is the goal kind of regarding security, is it kind of parity with the current option available or is there work to make it better than what’s currently available? Great question. Great question and also difficult to answer definitely. Because, of course, these Motorola phones will meet the requirements that are listed on our website, okay? But it is difficult to predict which of the available options, Motorola or Pixel or, for example, Pixel 11, will be outright better. They could be like trading blows in one regard or another. Remember, for example… I would just assume that for example with the secure element that the Pixels have a titan m2 and I believe starting with a Pixel 11 I believe uh that will even be upgraded to the titan m3 that is a very good secure element okay like that is a very good element so that’s that’s just going to be difficult to beat but at the same time because we are working so closely with Motorola on these phones um I would say there’s a lot of potential right like there’s a lot of potential because we’re working together with them so closely and we can kind of suggest changes as they come in so remains to be seen but I would I would assume that that both options will remain a good pick so so Who are public figures, for example, Edward Snowden, that GrapheneOS supports? I’m not sure if I understand that question fully. Do you mean people that support us, like GrapheneOS, like famous people of the kinds of Edward Snowden? Maybe you can paraphrase that. What’s another question here? Is there any way to use multiple VPNs at once for a user profile? I use Tailscale to access other devices, but I can’t seem to be able to use a separate VPN simultaneously, so I’m stuck making an exit node on one of my devices, but that introduces difficulties like not being able to easily change the VPN country and latency for multiple hops, phone, Tailscale, exit node, VPN through WireGuard. It’s kind of intended that way. I mean, sorry, it’s intended that each profile has its own VPN slot. I’m not aware that there is a way to use multiple VPNs at once in one profile. I’m not aware of that. I’m not exactly an expert on VPNs, but that would be news to me. And I would say there are no direct plans to change that behavior. We are already kind of busy. You know, fixing all kinds of VPN leaks on Android, which we’ve been squashing one by one. On the topic of VPNs, what apps and services on GrapheneOS are known to possibly bypass the VPN entirely? For example, Wi-Fi calling, connectivity checks, etc. Yes, I know connectivity checks do that. But, yeah, Wi-Fi calling might be another one. I’m not aware of any other ones. But, well, you see the wave of VPN leaks, etc., Have kind of shown that there is clearly a lot of work to be done on that side, on the front of VPNs. And it’s important work, of course, just by the nature of a VPN, right? Thank you. Thank you. Okay I got a clarification of that previous question people with views that graphene was is in favor of oh. Um. I I mean graphene was in general is very anti-authoritarian so I would say that whoever you know shares that kind of sentiment is probably up there but you know people have vastly different beliefs um so I’m afraid I cannot tell you any any specific names. Are there any estimates on GrapheneOS user counts I think last time I saw a post about it it was maybe 300 000 you Funnily enough, every time this question shows up somewhere on the internet, people link to this one forum post that I actually responded to. So I believe it’s pretty high up in the search results. I should edit the post. So last time I heard it’s over 400,000 users. It’s really difficult to give a precise number. In fact, it’s impossible to give a precise number because there’s no telemetry, right? There’s no statistics of that kind. We can only really look at the quote unquote statistics of the download server, of the update server that tells us how many updates get pushed through and make assumptions on that metric. I guess on to that question. This is my own personal curiosity. I think you guys have your own AS now. So you can any cast. The ip ranges that does that mean that updates then are routed to the nearest update servers wherever the user is geographically at this point um that is probably right I will admit um that kind of question goes over my head but yes we do have our own space um and it sounded like it was amazing but I will admit I I don’t know the specifics uh but I’m sure that you know one of our our devs would be happy to uh to further respond to that to the question of viewers maybe maybe drop it in the on the Discord or the Matrix yeah I always I’m fascinated by networking stuff I know it’s not the most popular topic these days because everyone likes to outsource to big tech but yeah. Oh let’s see Next-gen Motorola handsets are said to be officially supported, presumably this means the GrapheneOS public keys are hardwired, no warning messages on boot up. Will there be stock Android versions of the same phones? If so, does this mean those phones will pass the problematic Play Integrity API checks when installed with GrapheneOS? That’s a lot of ifs and questions. I can tell you that if a phone, like if the future Motorola phones do run, like, okay, sorry, let’s assume you buy a phone, it could be pre-installed with GrapheneOS, you could flash it yourself, that remains to be seen, the point is, so you’ve got that future Motorola phone in your hands and it runs unmodified GrapheneOS that will not pass Play Integrity. Like beyond beyond the most basic um verdict that will not that will not pass. Uh going back to I got um got a little message here uh going back to the to the question about the the dns and the our own ip space um I I’m pretty sure that is accurate what what you what you said there before yeah I believe that is accurate yeah it’s a pretty solid setup at that point then compared to I guess the previous setup where you didn’t really have that option yeah yeah it’s it’s it’s pretty pretty crazy yeah um. It’s nice right because um graphite always kind of carries a name uh so for example when we go on twitter or or maston or or wherever and and and we’re like hey can we get some can we get some servers we’re kind of running out of capacity we always get like so many so many providers kind of texting us and be like hey we can we can sponsor this we’ll sponsor that um so that’s um that’s pretty cool yeah cuts down and costs considerably right like that is pretty awesome and of course we do also have a sponsor page on our website so uh there’s that oh this question kind of goes with the updates tangentially why is there no option to turn off updates completely I want to decide when to update there should be an option and there is you can turn off updates fully you can do that um it is not like just like a toggle uh but that is by design because we don’t like just just don’t okay I mean like you can do it you can do it by disabling the the updater like you there’s an app on a graph in his phone I believe it’s just called updater or like update client if you disable that there will be no more updates um we we know you know we don’t we have not implemented toggle for this because it’s just a pretty bad idea to do in general I have personally seen way too many people that disable the updater then they forget and then like a year or so down the line they come into the chat rooms and they have some super obscure issue that nobody else seems to be having and then. It turns out you know you ask them for the big number and they’re just running a release from a very long time ago so uh the option is there but don’t don’t do it unless you have a good reason to right you Unless you know what you’re doing, just don’t. There you go. That would be my recommendation. Let’s see. I think for those of us who want to keep Play services in a separate profile or rather a private space, we lose the ability to use RCS messaging. Ideally, I would love to get everyone to use Signal, but I’m also a realist. Most people don’t want to install a separate app just to message one person. Does GrapheneOS have any plans in the future to implement RCS functionality into their own messaging app as an alternative to Google Messages? I would say yes. It’s one of those things that would be lovely to have. And it’s also one of those things that will be difficult to implement. And practice. But, yeah, that is, I mean, for sure something we would love to have. This one’s regarding Android 17. What does the GrapheneOS team think of Android 17 so far? And have there been any major issues observed? Some people have mentioned battery life in the chat. Well, the thing is with battery life, people, like, after every, like, update, there will always be somebody that, you know, brings up battery life and how it has gone downhill for them. But the truth is that most of the updates don’t even, like, change anything battery-wise. I mean, yes, major Android versions do that. But on the other hand, I’ve also seen plenty of people who reported an increase in battery life. So, it goes both ways um really depends on people’s setups uh etc. I I can say for myself that with Android 17 I don’t think I noticed like I mean you can’t really expect massive improvements uh I don’t really think I noticed uh like a significant improvement but it definitely didn’t get worse so that’s probably some some smaller optimizations. Here and there um oh yeah by the way josh I don’t know maybe you also feel up to the task to just see if you can answer some of those questions yourself uh oh yeah uh let’s see we can we can try that so you’re also a bit more interactive in that regard kind of forgot to mention that also another thing I forgot to mention maybe you know what I mean we’re just winging it right there’s no plans um but something I forgot to do at the start of the stream but how many people watching the stream right now are GrapheneOS users maybe type one in the chat if you are and type two if you are not kind of curious to know what kind of what kind of audience we have here. I’m just going to start a poll on YouTube quick see what shows up oh yeah you can do that yeah okay seeing a lot of ones in okay lots of other troll too in in the chats all right that makes sense I would assume that like on your end of things like in the in the streams you that um there will be a couple of twos as well yeah there’s definitely more more twos there all right but definitely a bunch of already existing users nice nice to see self-hosted chat or self-hosted stream shows the same seems like most people at this point okay yeah I see my comment in the YouTube chat just only yesterday from Android welcome welcome to the club here’s one question that I think comes up quite a bit and I’ll have my answer on it if you have anything to add how unsafe is it to use a Pixel 6 after the update support ends in october my go-to answer is using an end of end of life device is never safe I think people sometimes have this impression that if they aren’t a target then you don’t have to worry about it but at this point with you know mass exploitation things like that it doesn’t matter if you’re a target just matters if your phone is connected to a network Yeah, pretty much. You could be done for. Yeah. I mean, you know, just because you’re running an end of life device and you’ve not been hacked yet doesn’t mean it’s actually safe to use. Uh, I mean, yeah, like from a project opinion, you know, you need to switch to a newer Pixel immediately, but I would assume that perhaps this question is related to the Motorola phones. Perhaps they are, that user is looking to kind of bridge the gap and then buy the Motorola phone instead. But we don’t know when exactly these phones are coming out, right? And, uh, I think the, the Pixel six series, uh, yeah, in October of this year, they’re going to end of life. So not, not very safe to use, unfortunately. No. Okay. I mean, my personal opinion is if it was just a month or two, maybe it’d be like okay-ish. But yeah, it also remains to be seen what we do with the Pixel 6 series and also Pixel 7s. Because you see in the past, we used to offer extended support to the phones that launched with just three years of support. And we said we weren’t really going to do that for the Pixel 6 and above because they came with five years of support, which is decent enough. I’m not entirely sure if that plan has changed or not. I suggest maybe ask again when the time has come. But right now, we don’t. Don’t really have it planned but it could change right uh we could decide to do some extended support uh but the problem with these extended support releases is that um people often uh people often would keep using these devices as if they are still considered safe right and they’re not um they just they just aren’t of course you can do your best to to kind of secure them uh to get you on a new phone um but yeah remains to be seen. And the answers are well overdue yeah so on this one are there any plans for GrapheneOS to host a unified push server for those that can’t do it themselves. Um kind of basing off memory here but I believe that is something we could do? Yes. I think so. It’s a bit risky to just say that out now, but I believe that is something we could do. Yes. Potentially. Yeah. Yeah. Yeah. I would definitely put that in the realm of, yes, we could do that. What is your favorite feature? That GrapheneOS provides. My personal opinion, and Josh, maybe you can also give yours after that. It’s kind of the whole package. I love how in control you are of the OS. I like how you boot the phone for the first time after you flash it and it’s very empty. There’s no blow where there is no terms of condition in terms of service there’s a privacy policy you have to accept um it’s just the the like immediate relief and like this feeling um that the phone you’re holding in your hands is truly yours you know. Um so that’s that’s mine that’s my favorite yeah mine I’d say are the toggles under security and privacy they’re kind of the boring features the ones that can prevent an app from opening that you know might have a memory leak or something like that or the auto off Wi-Fi auto off Bluetooth just kind of small things like that yeah yeah it was a pretty good the I mean like a lot of the like security toggles like hard memory allocator yeah but not exactly um very um how should I best put it like in your face in a way right like the probably like the the scopes feature with the context scopes exactly sandbox Google Play that is like all of these things are are things you you kind of see in front of you um whereas hard and memory allocator like memory tagging all of these cool features they’re awesome but uh you don’t really you don’t interact with them too much right but they’re they’re kind of the unsung heroes um that are super important yeah it’s it’s tough when making YouTube videos on these features because I think they’re incredibly exciting but to show someone like hey look at this cool feature and you just toggle something and you’re like it’s there it’s working it’s it’s not big and flashy like some yeah exactly Google ad editing and image live or yeah yeah and also how do you sorry I just want to say how do you kind of present it to be or like presented or kind of in a way that is also entertaining right at the same time I mean very I mean for sure very. Content out there that um takes a deep dive into like hardened or hardened memory allocator for example there was a paper written about that some time ago which as far as I’m aware was pretty high quality as well but that is very on the educational sort of things right um it’s maybe doesn’t does not necessarily scratch the entertainment itch so on the topic of security could you give a quick overview of the security updates I forget the exact name of them but the uh security preview release I think it is there’s a couple questions about that that came up uh depends on the specific questions um but yeah with the security preview releases it is worth noting that these are technically not open source right like we cannot release them like that we cannot release the source code for these patches until Google kind of does themselves or like give gives their okay but we can distribute them as a binary so we can implement them into GrapheneOS via the security preview releases it’s just that you yourself cannot technically take a look at the at the source code but in practice if if you’re running GrapheneOS then you kind of trust us the the maintainers so there’s no reason not to enable it um there’s so many patches in there for so many months in advance um. Yeah it’s not a good change by Google um because it just gives bad actors so much more time to potentially. Abuse visa security holds um but you know it is what it is and we’ve kind of worked around it that way and it’s worth noting though that these patches that we’ve applied they are like they should be relatively easy to reverse engineer so someone could do that post in the internet and then it’d be fine it’s it’s a very silly system overall um very silly system doesn’t really protect it restrictions no no it’s it’s it’s pretty ridiculous but you know it is it is what it is seeing the Discord chat right now someone’s mentioning that everything is open source and there’s an answer security preview patches of an embargo that prevents source code publishing until the embargo ends yep that is pretty accurate. You can like we can say you spin We just cannot show them to you. So that’s why we have these like two release channels in a way where you got the normal graphite noise that is truly fully open source and then one with your security liquid previous security patches applied. If Vanadium has all the hardening stuff within it, is there any reason to use browsers other than Vanadium? Well it is worth noting that the Brave browser for example is doing pretty good on the anti fingerprinting front, as far as I know, they are doing pretty good work on that front. But I suppose Vanadium… Needs to improve on um but I mean yeah I would definitely recommend using Vanadium it’s a tough cat and mouse game when it comes to that yeah yeah and a lot of people kind of have the wrong idea on how to how to combat it um. There’s there’s a lot of kind of advice out there on the internet um where people tell you oh you know install this extension install that extension edit these settings do this and that uh but the problem is every time you install an extension or try to like fake something um specific like specific values you kind of just make yourself stand out more and not less yeah there’s great projects like piehole but at a certain point you know those help with third-party domains but when someone moves to using first-party domains to start serving their ads from Now you get into traffic inspection and it just gets infinitely more difficult at that point. Yeah, on a more direct privacy level, yeah, for sure. DNS blocking is something you can do, go for it. But the problem is just that the moment, for example, Facebook, okay, starts to route its analytics through facebook.com instead of analytics.facebook.com, you have two options. Either you don’t use Facebook or you accept that the analytics are going to pass through anyway. And I feel that is something that’s already happening pretty widespread. So I feel like this whole DNS blocking shenanigans, as I said, it’s something you can do, go ahead, but don’t feel too safe doing that. Um yeah don’t don’t feel too safe because I I feel like these kind of um features uh they they make you feel very safe even though you you may not be. What do you feel is the greatest usability issue bearing play integrity in graphene was at this time oh that’s a good question the greatest usability issue. Um you know what let’s ask the community go ahead um what is your greatest usability problem with with GrapheneOS or like what what bothers you the most can I ask the community community because I’ll be honest nothing came to mind immediately you So I’m just using this to get some time for me to draft a response myself. On that topic, while they’re putting some answers in there, I do think the on-device speech to text was a huge increase in usability versus someone having to go download it and figure that out, you know? Yeah, yeah, for sure. Especially in terms of accessibility, right? Like super, super important, for sure. That is also something that will be improved continuously over time. But yeah, that is a big win. We try to make it a great experience for everyone, right? So no matter what, no matter your personal circumstances or like your knowledge. A couple that I see in the chat over here is notifications without Google Play services. No matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what, no matter what backup handling yeah backup solution carrier things like voicemail. Yeah um backup solution I mean it’s I I think we included backup solution it’s called seed vault I don’t think it’s as bad as some people will uh want you to believe it’s it’s gotten better over time it’s definitely something that we’re looking to either drastically rewrite or just replace entirely um but uh I believe it’s it’s doing okay but for sure it’s it’s not good enough I I do agree um what was the the other the other one they mentioned uh kind of slipped my mind oh notifications without play services yeah well that is something you kind of need to ask the the absent question right like to kind of ping bro devs for example proto mail right doesn’t really doesn’t really give you notifications unless you have Google Play um perhaps something they should uh they should get on tap the pay is another one that I see commonly come up yep yep that is a good point yeah uh the thing is like energy payments they do work on GrapheneOS the problem is that many banks kind of rely on Google wallet or Google pay to kind of handle it in the background and it’s it’s you know Google pay that doesn’t work because of play integrity um so that is uh rather unfortunate if all the banks start using Google pay in the background for its functionality and Google pay doesn’t work um but if you if you if you have a bank that kind of features its own NFC implementation then uh you might be fine you might be okay I I do admit I believe in the us. At the very least um there pretty much is no no bank that kind of has its own system in place anymore there are some in the like eu space but not so much in na however um if you have a smart watch you can do you know contactless payments for that um and for for the people in the eu you can also use something like curve pay um or more or to be more detailed in the european um economic area yeah I’ve heard people having good luck with garmin smart watches I think is what it was yeah yeah that works yeah yeah for sure oh here’s a question I’m actually curious about too uh does GrapheneOS us have any opinions on services like cape that offer imz rotation is that kind of a gimmick or is it something that’s actually useful in terms of privacy. Um I don’t believe we have um talked about that specifically and I’m afraid I don’t really have much of an opinion about that myself so I can really answer that um I can tell you that cape definitely is gaining a lot of popularity in the privacy space or at least it does in my in my kind of field of view but we’re not partnered with them they they do send us um what is it I believe like the first I think if you are like a new user I think like the first month of payment goes to us if I’m not mistaken something along those lines but they do like donate to us um but yeah it’s it’s not really a partnership in that regard. Our only partnership is with Motorola but Motorola there’s no money changing hands. Um so yeah on the topic of Motorola I’ve kind of seen some theories on the benefits that they get you know having an offering of a secure device they could offer to enterprises is there anything else that’s kind of hasn’t been really talked about in terms of what benefit they get having a partnership like this is I mean GrapheneOS is widely recognized as the pinnacle of mobile privacy and security you and I I would say that having that name in your portfolio in in a way is a pretty big win on its own and is something you can definitely market market with like your your products or like Motorola’s products whatever they they have cooking in the background let’s see. Where is the stream yep it’s happening right here. On the topic of usability issue default apps especially gallery yeah I don’t know if you if you heard it before but gallery is in the process of being replaced and there’s some good work done on that front as I said uh but it’s not done yet but yeah progress is being made um like my my personal opinion is that yeah default apps uh pretty crucial to to rework um for sure for sure it’s just um it does a lot for like the initial impression as well right maybe makes it a bit more welcoming in a way. Oh speaking of first impression had a question from earlier it’s two parts so why are there no images on the website the person said they think it would help when someone’s trying to decide if they want to use GrapheneOS or not and why the pure black theme for everything. Um yeah good question um I I don’t necessarily disagree but some questions could be nice that would kind of be part of like a bigger website refresh that we might do in the future. Yeah, I mean, there’s definitely a lot of things you could do for sure. Yeah, maybe compartmentalize some of the wall of text because my personal thing is that maybe that is sometimes a little bit makes people maybe a little bit scared. I also think that some people think that there’s this massive document full of documentation and the feature page and everything. But in reality, you don’t actually need to read the whole thing or much of anything because in practice, most of the user facing features are somewhat self-explanatory, and if they’re not, you can always consult the docs, the docs, the documentation. Later on or you know ask in our chat all right let’s see. It’s going to your gallery was already unacceptable an Android kitkat what even is that user experience fair enough yeah fair enough um fair enough. Oh here’s one will we ever be able to get an in-depth interview with the GrapheneOS founder. Uh so daniel mckay um never say never I would say. But so that I can confirm or or deny anything yeah kind of tough to answer that um someone also you have yeah pretty much pretty much do you have any insight to the process of getting in partnership with Motorola like was it a quick thing was it multi-year was it um yeah that’s definitely something I I can I can say to that um it’s pretty funny because um when we did this announcement that we’re working with a top 10 Android OEM right um it was so funny to see the like conspiracy theories and the investigations done done by people but the thing is in reality if you were paying really close attention to, I believe it was the Discord chat, we had a Motorola employee. Yeah, so saying it here, Moto devs just kind of showed up in the dev chat one day. Yeah, that is exactly what happened. They just showed up on the Discord and were like, hey, let’s see if we can like work together essentially. It was just like a couple of messages. I think it didn’t really get widespread attention. But people who like saw those chats, you know, they pretty much already knew it was Motorola. So that was pretty funny. Do you think GrapheneOS would ever be willing to provide new notification sounds, ringtones, background images, etc. I believe that the ringtones and and whatnot are just the ones that come default with AOSP, right? I mean, maybe? Perhaps we could include the ones that come with stock, for example. We just heard at the start of the screen that the onion is rocking the default application sound. I do, yeah. Honestly, I kind of like it. It’s nostalgic. Yeah. I don’t know. I’ve kind of been rocking it since the very beginning, since I started using Garfin was in, what was it, May 2023? Oh, somebody says, I’ve seen a Qualcomm employee here before. Missed the Motorola one. Yep. Yeah. The Qualcomm employee? Yeah. That could also be. Next question. Yeah. Yeah, it’s pretty interesting, right? If you just pay close attention. In a way, this Discord is a bit of a spoiler sometimes. But yeah, we got widespread support for the Motorola partnership in general. There was some controversy. Maybe it’s worthwhile to point it out. But that there are essentially, I mean, you see, there is Motorola Mobility, and then there’s Motorola Solutions. And they share the name Motorola, but they are very distinct companies that are doing their own thing. And we are part of Motorola Mobility, the smartphone maker. Any questions on your end, Josh? Yeah, actually, this one’s from me. Or I guess… Guys could just make a statement on it so a lot of people like to use the term rom and os interchangeably even though they’re not could you uh kind of give a quick summary on that just why GrapheneOS is not a rom and why it’s an os um yes so the term rom stands for read only memory and so that kind of already implies that GrapheneOS is not a rom and it’s also implied because GrapheneOS has the two letters os which you know stand for operating system and uh so yeah I mean it is a full-fledged operating system um just like lineage os is a full-fledged operating system and the reason we don’t really like people calling graphene was it wrong is that okay a it’s just straight up wrong but b it um it kind of gives off the impression that it’s some kind of like hobby you project right uh and we we don’t really want that impression um because it’s it’s not right um it’s a production ready system and people should uh view it as such. Yeah I think that’s a good distinction to make because it does come up every so often but we’re far from the rom days on Android os um so to kind of circle back to the Motorola question when I mentioned that you know they were kind of showed up in the Discord I believe I didn’t actually answer that question fully kind of getting mixed up here a little bit um because we’re juggling multiple chats I just want to mention uh yeah so you know they they reached it out to us uh which was pretty cool and um yeah as I said there is no money changing hands um you You know, mutual benefit is that we get the support from Motorola, which includes, you know, the developers, the engineers, which is super, super helpful. And, well, they also get our expertise, of course. And, in a way, the GrapheneOS brand, in a sense that they can then advertise how they’re the ones that brought GrapheneOS to a non-Pixel. Because that is something I’m sure a lot of people have thought about. Like, you know, why did we, like, why? Sorry. Why did, why do we. Have not released a graphic device phone until now right like why why why so late right like why why are you with Motorola um and the truth is like a lot of OEMs have reached out to us in the past and you know a lot of these OEMs um were also very motivated to work with us and you know that’s great because I in my opinion motivation is like half a deal right you need to want to to to work with us to actually realize this um the problem is just when you are a small OEM you don’t necessarily have the manpower um and everything else that kind of goes into a project like this okay like of course we we could have already released some average phone with for example a mediatek chip Like just kind of average hardware with, at best, average security, but that’s not what we’re doing here, right? If we’re going to release a phone or if we’ll help to release a phone that should carry the GrapheneOS branding at the end of the day, it needs to meet our requirements. Because, you know, GrapheneOS is also a brand, right? People hear GrapheneOS, they trust GrapheneOS, they know if they use GrapheneOS, they get the best of the best. You know, some people’s lives depend on GrapheneOS. So we will only release something that we are absolutely certain of ourselves that we believe in. That’s something I wanted to mention. Has GrapheneOS received any user data requests from any law enforcement agencies in any country? That’s something I want to mention. Like, IP address logs of users who downloaded the OS from the site? I don’t believe so. My first hunch says no. But there is also simply no data to share. Like, you know, like, for example, like, kind of a little off topic, but people always hate on, like, support, like, privacy companies, like, for example, you know, Proton, like ProtonMail, et cetera. People would hate on them for complying with, like, a valid warrant of having to give out user data. And, like, you know, if you want your service and company to continue existing, you kind of have to comply with the law. But at the same time, if you just don’t collect this information in the first place, there is nothing to share. You know um and that’s just how all our services work um there’s no telemetry there’s no real identifiers there is nothing of that kind um yeah like there’s no real risk of of of getting that that kind of warrant um but yeah I’m not I’m not uh I’m not aware of any any such requests since you guys don’t keep logs has it been difficult to prevent abuse at all you know if you get ddos and you don’t keep many logs you really can’t filter or block the traffic so it’s kind of the the idea like just have enough hardware to take it sort of thing yeah um not really in terms of like ddos I mean ddosing yeah it did like does affect us as well of course but um recently we’ve had to deal with just a little spam. Also, no forum. I mean, we discussed with Josh, there was a lot of spam and forum. And that is problematic because we don’t really collect any info. There’s no there’s no capture system, right? Because that’s not exactly privacy respecting most of the time. And I don’t think many people would exactly appreciate that. So yeah, that is kind of a problem sometimes. Yeah. But we do end up coming up with with solutions at the end of the day, to to handle that, that sort of, that sort of trouble coming our way. Circling back to the topic about ROMs and why we, you know, Graphic Noise is an operating system as well, got a comment that we also work on the yeah, we do indeed also like work on the on the kernel, right? We do kernel adjustments as well. So it is indeed a production ready system, but isn’t just like surface level kind of changes. That is why it should also be regarded that way. And back to Motorola, since that’s still a popular topic. Yeah. Understandable. Yeah. Is it confirmed that GrapheneOS will come pre-installed or will it be similar to a Pixel where the user has to handle it themselves? That is not confirmed yet. Dot. Fortunately, I cannot give you a more precise answer. It is definitely something that a lot of people will want. And I mean, we want it too, but yeah, nothing really confirmed yet. But hey, if we have something to share, and we will, we will let you know. Are there any other open source apps or projects that GrapheneOS endorses formally or informally or that you personally like? Another great question. We, like, in general, don’t endorse many things at all. Because we also think that, you know, people should just kind of do their own research and decide. Based on that research, I mean, we do often talk about different kinds of services and kind of give our opinion on a technical level, but we barely endorse anything. Honestly, the only thing that comes to mind is the Accrescent App Store that you can actually find in the GrapheneOS App Store on your phone. If you, for everyone running GrapheneOS isn’t ready. Yeah it’s it’s one of those few things that are in the app store because it also has a security benefit it there’s just a nice chain of trust already established because you see if you install graph in os you verify that your install of graph in os is genuine then so is our app store which means that the crescent installer is also genuine and then you know a crescent itself also does a bunch of verifications and so you know it goes from GrapheneOS installed verified that means a crescent is verified that means the apps that you get from a crescent are also verified so that is that’s nice but yeah a crescent is definitely one of those uh projects that I would say we we do that indoors yeah so let’s mention signal and body yeah I I guess yeah I mean I don’t think we need to endorse that too much um just because it’s pretty known in the privacy community like signal and like it’s fork molly pretty much the staple. Speaking of verifying like with what comes pre-installed I have a tough time explaining this to people but could you maybe give some insight as to the benefits of the auditor app and maybe how that works at a high level and why it’s beneficial to use uh yeah so the auditor app kind of uses hardware based features to crypto graphically verify the integrity of your os and you know you can do so over a period of time as well you set it to like I don’t know any any number like every week it’s gonna uh it’s gonna do a routine check uh through the remote service you for example and it’s gonna like print you the data that it gets from that it’s gonna tell you hey your phone is in the dispatch level you know your bootloader is locked. Essentially everything’s gonna be fine and yeah it’s very good doesn’t cost you anything so just leave it running. Is it just set up remote at a station is like a hash of what the os is currently at or what’s going on or is it more than that or like what specifically maybe is it verifying and how yes it does also like verify the verify boot keys and whatnot. So oh this might be a good clarification on the crescent question so if you endorse a crescent is that a secondary endorsement of the apps inside of a crescent um no because like you know the GrapheneOS team doesn’t really decide what what apps get into the crescent store um I mean the main developer of the crescent store is also a a bot um like in the in the team so you know they’re no stranger um but they likewise don’t really I mean they do of course decide what apps go on their store also because um it’s currently in alpha state right and uh so there’s not too many apps on there but the point is that you know the store could also um somebody could also like upload a proprietary app on it and it would also be welcome you know at some point in the future um um so no we don’t exactly endorse any of the apps inside and along those same lines someone also mentioned that inside the GrapheneOS app store if you go to the messaging app it used to say that to use a secure message app such as molly signal and simple x but it seems like I guess that was removed I never realized it before has the recommendation on simple x changed at all um what up so the SMS app right yeah inside there the description oh the description um um I believe that just has to do with uh I um let me let me think about that for a second trying to recall what happened there Okay, luckily, I have some of my colleagues kind of help me out here and there. So shout out to those. I believe it was just because like Signal and an extension Molly are just kind of easier to use, kind of more mainstream. They’re just easier to use than SimpleX. So I believe that’s kind of where it comes from. Yeah, that is a good point. Yeah, you’re right. That was mentioned in the past. Also, hello, shout out to Akason, one of the fellow mods. I got another one here unless you want to throw in a question um this one I’ve seen come up in the forum time and time again so I don’t know what the answer is going to be but what devices are used for building apps and os releases for security what is recommended because it has to be a desktop pc um terribly sorry can you repeat that like that question again I I I admit I kind of zoned out there for a bit on that first part I’m not gonna please repeat yeah I’ll reword it to so the question basically is what os is being used to build GrapheneOS and what desktop os is recommended um great question uh a question is very difficult to answer because we don’t really give too many recommendations on that in that regard, because I mean, we do talk about which one is technically better. As for our own like infrastructure, I believe with pretty certainty that it is Arch Linux. So there’s that. But as for what desktop OS were a comment, I mean, the truth is they’re all really far behind like Android or iOS. So there isn’t like the perfect recommendation to make. I guess there’s just a recommendation to make that is a little less bad. Yeah. I mean, I’m not an expert on these things, but I believe that on the Linux side of things, Arch Linux is one of the better options just because of how fast updates come out. Right. And you know they don’t do any kinds of weird like um configuration uh messing around with that um they just release the updates everything’s good the follow-up stream and uh yeah so I yeah I guess on the desk on the desktop the next side of things um arch is most likely one of the one of the better options but you know that doesn’t mean that desktop index is a good option as a whole right um oh someone asked what os do you use personally uh yeah that actually um contains what I just want to say um you know that doesn’t mean I mean it’s a bit of a philosophical matter because it doesn’t mean okay decilinx isn’t as good um it’s just using an Android phone but not everyone can move all their computing needs to a phone right even with um desktop mode coming coming to Android and and Pixels right like that’s that’s kind of out there and it’s continuously improved um it’s not necessarily a full-on replacement as for my own needs I do also use arch and I also use windows for some for some use cases. Yeah I mean ideally you use your graph in osfer that is the the ideal um the problem with um desktop operating systems is uh you know they have a a large history to them um They’re pretty old, by all accounts. So they just come with a lot of kind of legacy craft, a lot of kind of bad design choices that on the mobile end of things were luckily mostly avoided because mobile phones kind of just came later. So that is really the primary reason why. Yeah, desktop operating systems are pretty far behind. I had this dream one day that I just come home and I plug in my GrapheneOS device to a monitor in like a docking station. And I use that for the desktop. I take it with me when I go, but hopefully someday. I mean, you can do that, right? Like you can do that for DisplayForward, I believe. I think, no, HDMI should also work. But the point is that DisplayForward is like. Officially it’s it’s fully there the support is fully available for the Pixel eight and later so unfortunately if if anyone listening right now has a Pixel seven or older I’m afraid you are lucky in that regard but it is what it is the hardware support is only in the of the newer Pixels. Um how much you can do there but yeah I mean desktop mode is a thing for Android and it’s it’s really usable I’ve not tried it myself but supposed to be usable. So there’s one question here why not secure blue for the GrapheneOS team um good question I I mean this is just my uneducated assumption but I think a lot of it also has to do with the fact that the infrastructure is kind of already set up and it’s it’s working well because of course we also apply our own hardening um I I would assume that the answer is don’t change your running system there you go. Kind of on that topic of desktop um how are the keys secured for builds. Are the machines air gapped at all the machines are air gapped yes um kind of really tell you much more beyond that because you know I suppose sharing the exact configuration is a security risk on its own but you can bet that these machines are highly highly secured so which they should be you know if they contain the the keys or if they’re used to to sign the bills for sure very very important. Would any features found in Motorola OS be shared to GrapheneOS should they want it or sharing code to fix an issue like the old prominent Bluetooth pairing to a car issue. Potentially yeah I mean there is just a lot of kind of teamwork so if the topic kind of comes up I’m sure they can help us and you know we can help them. As I said I mean Motorola is a very very strong partner for sure. All right I think that’s about it on my end josh I don’t know if you have anything anything new on your end on the stream chat a couple here uh do you guys have any policies in place like incident response sort of things like what if signing keys get leaked is there like a plan of action to do or is it more if that happens we’ll handle it then um there probably is some internal pan um but I’m sure the the plan a is that this never happens and everything is done to stop that from from ever happening. But yeah I I can’t really give you the details on that because uh naturally I don’t uh deal with it with a sign case. Let’s see oh someone asked me why I have the name side of burritos uh oh thank you I forgot to to ask you this I was curious go ahead yeah so basically so I do like burritos I think they’re superior to tacos and when I was looking to begin a couple criterias I had for naming were nothing that gated me into a specific topic because funny enough the actual like first videos I had or ideas for this channel were personal finance videos they’re all hidden at this point so you can’t see them anymore and I also really wanted a dot com and that’s pretty tough to find at this point so side of burritos it kind of landed on that and here we are yeah I mean it’s it’s catchy right why why have a generic sounding name if you can be called a set of burritos or or a spring-onion yeah exactly yeah you understand Yeah, exactly. You know, people will remember because it’s just extraordinary. Two questions here that are related. What are the responsibilities of a community manager and do I love my job as the community manager? Responsibilities can range. To a lot of things, really. I mean, in practice, it boils down to talking to people, really. That’s the most, I guess, primitive action there is if you boil it down. Talking to different people, communicating with different people, making sure that people understand what you’re saying. Someone says, I shall be using spring owners in my- burritos next time I have them to celebrate this live stream it’s a great idea yeah man I mean I I believe you can put spring on it uh spring onions on on anything so pretty much but yeah I mean yeah just just talking to people um and you know maybe um. Maybe this is a great time to talk about another topic that I have seen somebody uh drop in the chat here uh the I don’t I don’t remember the exact question but they asked um how to best phrase this they they kind of asked um how will we handle um like social media backlash um I believe it was in that kind of spirit um maybe it’s something along the lines of or how do we how do we look to to kind of improve on that front and um I I have a a lot of things to say about that uh so maybe maybe stock up on your on your popcorn um so I mean from from from my perspective it’s like um you know there are some people out there that will you know they want you to believe that this is like a massive problem and you know that like we hate everyone and we hate every project and uh all kinds of you know other other claims like that um and uh I mean what what should I say I mean it’s it’s just not true I mean yes I I’m of course biased um however. The kind of inherent nature of the internet and and social media is that people kind of they’re they’re quick to believe what they read like first um not many people actually go through the effort to like investigate what they read um and in a way like negative news or like negative press um also achieves a lot of engagement uh which kind of worsens the the quote-unquote problem um but what what a lot of people or what these people right I guess that are maybe um I don’t want to use the word hostile but maybe the the kind of people that are not maybe not the most friendly to us um what they like to kind of exclude and and not mention you Is that there are plenty of people we don’t hate and we don’t have problems with. Um, I mean, like, for example, on the side of like content creators, we have you, Josh, you know, we have, I don’t know, uh, Naomi, shoot, what was her last name? Was it? Oh, Brockwell. Well, yeah, or, or that, yeah, I keep mixing up. We have, you know, we have you, we have Naomi, we have David Bombay, uh, where that interview with Metroplex is, is, is that, uh, definitely watch that if you’re interested, um, we have, you know, the hated one, uh, who also made an interview with, uh, Gabe, AKA Floodwald, one of the, one of the devs, um, you know, very, very blinders tech tips. Um, so we, we are, you know, very good, um, quote unquote relationship with, with all of these content creators, for example. Um and also what a lot of people are like what yeah what kind of most people don’t see because it happens mostly behind closed doors is when you know people reach out to us okay um maybe they they got banned um but that can be for many reasons they reach out to us and the truth is oh wait someone says in terms of content creators pewdiepie as well yep that is also technically true he also made content um like if you know it’s related content uh the point is what what many people don’t see is that people pretty often they reach out to us and they say hey I’ve been banned or hey you know whatever happened in the past let’s let’s talk it out and that also happens from our side you know we do also reach out to people from from our side as I said that is something that is kind of hidden from from the public but but it does happen and and you know people who um may have for example spammed the the chat rooms for a long time or trolled in in other ways um you know these people you know some of them are in fact in like the Discord chat for example and being very like you know they’re productive members of the community or well you don’t need to be productive but you know they’re very welcome in the in the chat rooms um so so there’s that um um the the point I’m really trying to kind of get across is that there is always two sides to a coin and the problem with the internet that people often only see one side of the coin and not both of them right and that leads to issues. Sometimes so um you know that that doesn’t mean that we are like infallible and that you know we never make mistakes ourselves you know that’s not true um but the point is that we are definitely a lot more approachable than some people will will want you to believe so there you go I think I think that pretty much uh summarizes what I what I want to mention I do want to add too um it’s tough being online my community is much smaller than obviously GrapheneOS but it’s a lot of work it might sound simple like I just reply here reply there but when you have you know thousands of people something goes viral it can be very difficult to kind of yeah not control the message but get a uniform message out there that sounds good especially when you’re trying to combat something that is misinformation the way I look at it too is there’s some people out there who like to use the the strategy of two truths and a lie so they’ll say something of yeah Google spies on you this happens now let me throw in my thing that I’m not going to prove but since you believe the first two truths now yeah yeah those sound better and to disprove that it just takes so much more work and they don’t want to justify it usually there’s yeah there’s just a lot that goes into it that is an amazing point you know it is it is unfortunately significantly easier to spread a lie than it is to refute that lie often right um especially when it. It gets messy and it’s difficult for people to kind of collect all the information that is, yeah, it gets very messy for sure. Yeah. Especially when you’re looking to hear something that you want to hear like, okay, Google is listening to me through my phone. Oh, great. I wanted to hear that. I don’t care what information about it against it comes out. You know, not saying one way or another, but it’s just a lot that goes into it. So I think you guys do a really good job at moderating that for what it is. And the community is very picky on a lot of stuff. And so, it could be tough. I mean, there’s a lot you could say to that. I don’t really want to blame the people only. The point is like, you know what, let’s take Linus Tech Tips as an example. Probably a little… Surprising because you know his video is is pretty good um the point is what happened when the video was released um but you know the videos is great okay um it’s it’s very good you know it has one or two mistakes but um it’s it’s still a very very good video the problem is when it was released it had a maybe um more questionable title and and thumbnail you know it was it was essentially clickbait okay um it was it it kind of uh portrayed graph in a way as something for criminals you know it was it was just a joke okay it was it was more clickbait um it wasn’t really meant serious um the problem is when when I when I saw that and then you know I I checked out Reddit it and people were complaining about you know linus detectives doing this thumbnail in this title um and then I you look on the like att subreddit and I I see the same thing but like kind of vice versa where you know the the att folks are kind of complaining about the graffiti community um and how you know like we don’t understand a joke right and suddenly we had these like two camps of people um that were both kind of right and wrong at the same time um and so what what I did then is um I I drafted a a post okay on the addt subreddit and I kind of just tried to uh bridge the gap between these two communities uh and uh fine enough the the post is still up um that post it took me what was it I think um yeah I think I spent. Um four hours on that post like just drafting it and selecting the right words it worked great like it got tons of upvotes like over 1k upvotes which is honestly a lot I would argue people pretty much agreed across the board and I like to believe that that kind of helped to to bridge that the gap between these two communities um I think if you just talk to people um most of the time that that helps a lot um yeah I mean points also people often kind of run around with half-baked knowledge uh superficial knowledge and you know that just happens because not everyone can be an expert at everything right and that’s okay the problem is just when you inadvertently spread that half baked knowledge um it can it can become very difficult to rectify that to to fix those those kind of misunderstandings because um many times the people involved um like it becomes a very kind of emotional topic and it’s it’s very very very difficult to to navigate at times um. So yeah maybe that is that’s going to help to give perspective on that I think you guys had a good point about when it comes to like misinformation being spread on why you don’t block ai bots to the forum because at first I was thinking yeah block them why let them have the information but if they get it directly from you at least they can hopefully provide more accurate answers if someone does go that route for information yeah yeah exactly like ai is just whatever is on the internet right so it makes sense to to try to feed the ai yeah the more accurate information so but uh also on that note I think it’s also worth adding that uh like we are looking into ways to um do better in the sense of like informing people in a yeah in just a better way um for example moving to maybe kind of longer winded blog posts where you can explain everything piece by piece uh kind of give like a timeline of things um and and yeah try to Try to figure out things that way. There’s a question here, will GrapheneOS support Motorola tablets in the future? I mean, the plan is to continue supporting future Motorola devices. You know, I don’t know if they have a tablet planned. But, you know, if they do and they meet our requirements, why not? Yeah, I mean, we also support the Pixel tablet, right? What programming language is GrapheneOS trying to avoid and why specifically C++? The question I got. Are we specifically avoiding C++? I’m not sure. That is a question. I cannot answer I’m afraid I’m not aware of any like specific language that we outright avoid at all costs as far as I understand you know some some some languages are just better at at certain at certain things oh wait a second. Oh yeah that is a good point as I said sometimes I get some DMS here here and there but that kind of helped me out it’s memory safety which makes sense you know like memory corruption bugs are like a great source of like overall vulnerabilities in general as a whole you know that is why we have hard and memory allocator that is why we we love memory tagging and that is also why we like rust because rust is doing a lot better in that regard to um reduce or you know not introduce memory bugs in the first place it can help just eliminate it all together at that point then instead of trying to patchwork another language that because it’s yeah it’s it’s like super easy to kind of make these kind of like memory corruption bugs like mistakes in a way when like programming in like c or c plus plus and whereas it’s as far as my understanding goes it’s rust for example is a lot a lot safer or like java kotlin how it’s considered memory memory safe as far as I’m aware or at least they do much much better much better job so oh here’s one are you paid for this job or is it purely a voluntary thing um. Would say I mean first I’m kind of talking like in general I would say that most people. Start as volunteers um at least the the non-devs um but but even I I think even like a lot of the devs probably started like volunteering first and then you know it became apparent that they they have a necessary uh skill set and the time to actually go full-time uh but yes I I do I do get paid yes but yeah I mean initially I was a volunteer for a long time so and then kind of speaking to contributing uh what would you recommend someone learns in order to contribute to GrapheneOS or to contribute to the Android ecosystem if they are a complete beginner do you have any places on where they could start or suggestions um in terms of like how to like get the basics down in terms of like just general programming knowledge yeah I think that’s what they’re asking about kind of just in or just in general for Android specifically like how to get involved in or get started with app development or just like the base os yeah honestly that is also one of those questions I I don’t think I can I can answer I’m afraid um it’s I think it’s best if you yeah bring bring up that question in like the dev chat perhaps um maybe hey maybe someone watching right now has a has a better understanding someone says it’s commendable but you’re comfortable saying I don’t know instead of attempting to dodge the question or make up an answer if that’s a big sign of trust in my opinion no thank you yeah I mean yeah I mean like you know not everyone has to be the best at everything. So that’s that’s all right um I’ve been told that uh Google themselves have Android development videos like videos on their side so maybe search for those that that they may probably give a they’re probably gonna give you a rough idea on how you can start get going yeah I think developer.android.com has some really good stuff to kind of get you started most likely that some good reading too on there and uh something maybe another topic you know I I really like the the mix uh today because uh yeah sometimes I’m talking sometimes you’re talking uh sometimes we like take questions from the community sometimes I just talk on my own and I think this is one of those uh scenarios uh because as if it’s something I wanted to kind of talk about um like how you can contribute to project like in general okay like of course you know the first thing that comes to mind is development work yeah totally makes sense absolutely correct um I mean GrapheneOS has a software project right um well for now um so totally makes sense that development and programming uh comes to mind first but there is many other ways you can contribute okay you know the second thing that comes to mind is donating money yeah also very helpful for sure no no doubt um but you can do a lot of things even without money or without you know development skills you can answer questions in the community right like there are always people looking for help with. Like installing the os for example um I I don’t know how many people I I help you with that probably um like hundreds at this point yeah just like answering questions you can for example also help with our little banking project that you can find on the privsec website or alternatively just search for GrapheneOS banking list with the search engine of your choosing you know you can file a report there or update the report or just you know let us know that hey this app is working totally fine because that’s also very useful and another way you can you can really contribute and really help and this is my favorite part because this way to contribute does not require any like special like knowledge or skills or anything really it’s to just voice your support for the project like online on the internet you know whenever you see it mentioned just voice the support for it like that alone is very very helpful so if you if you can do just that that’s already just brilliant honestly and you know it’s it’s very it’s very low barrier of entry in that regard so if you can if you can do just that that’d be that’d be awesome yeah. Yeah I think that helps a ton because you know someone might see something bad about the project once you start digging into it then you see all these messages and positives about it I think that makes a really a really big difference when people are just beginning to start with it so it definitely helps yeah it kind of also just circuits back to how the internet works for most of the time people go online to like when you know when when something doesn’t work they go online to complain about it right but people rarely go online and say oh you know today july 20th this app or this service or you know whatever has worked perfectly fine lovely you know and then moves on with the day you know that doesn’t happen people people go go there to complain right which which makes sense why would you say anything if everything works but that can also kind of distort the view in a way because like in general right like you can maybe be interested in like a certain service a certain app and then you I don’t know you go to like a subreddit and you see people complain all the time but what you don’t see is the amount of people that don’t complain because everything is working fine so um and also you So because of the inherent nature of the project and the fact that, you know, it, of course, caters to people that are interested in their privacy, that means that a lot of people, a lot of these, like, Graffino’s fans are not necessarily very active on social media, right? I guess the more common social media, you know, I know that there will be a big slice of users, like on the Fettiverse, for example. But the Fettiverse, I’m afraid, is not social media, I would call, like, the most common one, okay? Like, most common would be, like, something like Twitter. So that’s a thing. So, you know, if you happen to be active on social media, then… And, you know, your support is greatly, greatly appreciated. Yeah, it’s a tough industry to be in because the goal is to be private. So you’re not going to talk about it. Or in general, you’re not going to. Pretty much. Yeah, but people should talk about it. People should talk about GrapheneOS. They should normalize also running GrapheneOS. I see that every now and then in our chats, how people, for one reason or another, want to, like, for example, hide the, like, you know, when you start your phone, you get, like, the Google logo and then it switches to the GrapheneOS logo. And people ask, how can I hide the GrapheneOS logo? For many reasons. Most of the time, they think that this is some kind of security feature to make someone or to make it harder for someone to identify that, you know, your Pixels are running Graphene. OS, even though that doesn’t work because like verified boot will kick in. It always kicks in, right? Like when you start your phone, it tells you, hey, this phone is running a different operating system and then it displays this hash and this verified boot key and you just compare it to one on our website. And then there you go. That’s how you know Caffeine OS is running on it. So, um, hiding the, the logo doesn’t actually achieve anything, like nothing, which is why this is not a feature because it doesn’t do anything like generally. Um, there’s a lot of talk over things I see proposed like security through obscurity, which in my opinion, isn’t really security at that point. Yeah. It can help a little bit, but some of that stuff is more for show. Yeah. I mean, there is honestly, there is just like a lot of security theater like out there. Yeah. Um, let’s take, let’s say. Banking apps for example okay so we’ve been like the past few updates to graphic us have been focused on like re-implementing our secure app spawning okay it’s a very very important security feature um so before it used to be like global so if you disable it it’s disabled for every single app which is not great for security point is we rework it to be app specific like all the other security features so you can kind of just disable it one by one that’s great because that allows for greater app compatibility for example with banking apps um most people will know that best I mean yeah majority of banking apps do work on griffin os uh some don’t um in part because of plain integrity However, there’s also some apps that rely on some really stupid, like anti-tampering libraries, okay? And these libraries do all sorts of weird checks and weird, like, they have all sorts of weird detections in place, and they’re terrible. You know, banking apps love to kind of pat themselves on their shoulder and, you know, talk about how great their security is, okay? But then you have these apps that have these anti-tampering libraries, as I mentioned, and they’re just horrible. Like, they don’t actually do anything. They just make it harder to debug for us. So that is something we’ve been working on lately. We’ve just been trying to reverse engineer these libraries that are figuring out what the heck are you guys doing, you know? What are you doing? And trying to work around these issues um so so yeah that that is a a big um a big problem in a way where apps just have weird libraries included weird sdks that in the name of security but you know in in reality okay they they don’t improve security they just decrease security um I think part of the issue too is I used to work for a company that some of our customers were banks and we kind of protected their websites and services and I I know for a fact all of them talk with each other so I’m sure one is like hey I found this cool library put it in your app the other security team does it now they all do it and it’s just down that that does happen that does happen yep unfortunately it does happen but I mean hey luckily it can also go the other way around yeah you know we we have a guide um for like app devs to implement like the hardware at the station API or like to to whitelist graphite os through this hardware attestation API and this is in simple terms essentially and like a much better alternative to plain integrity okay like if you want to verify the os just use the hardware uh maybe hardware at the station API because that is neutral and that you know actually gives you useful information and hey we we have had apps actually implement this hardware station API to mind com uh the swiss uh banking apps they’re called you and swiss quote that both implement hardware station API so that’s great there is another app um it’s some kind of like. Government app or something along those lines or some kind of like identity verification app also in switzerland um that has kind of announced hey we’re going to look into graphic os support which is great or like another kind of example is like the twitter app like the x app um that in the past you know that it wouldn’t let you log in unless you had a passkey um I believe that should be fixed now maybe somebody can confirm that I believe that should be fixed because I saw like a twitter engineer post about it they said hey we’re going to look into graphic you know support and then somebody mentioned hey yes this works um so it would be nice if somebody could confirm but you if it if it doesn’t work yet I’m sure that is in the pipeline. Yeah hopefully those kind of recommendations can spread because it’d be nice instead of everyone doing their own thing and then blocking it from being able to be used and things like that yep yep it’s it’s and another really um funny example okay is Roblox okay um somebody found out that if you go to the like faq page of Roblox there is like an entire section hey what about custom operating systems does like the Roblox Android apps support those and versus this section that you know we investigated on a case-by-case basis and graphene was is actually listed there and they actually support graphene works yeah there’s a full like technical rundown and everything which I didn’t really expect, but, you know, that’s lovely, right? I feel like that’s the last app I would expect. Like, oh yeah, Roblox. Yeah, it’s funny, but hey, I mean, the more apps, the merrier, right? Yeah. Here’s an interesting comment. GrapheneOS always operates under the assumption that an attacker has encyclopedic knowledge of GrapheneOS at all times. GrapheneOS is open source, publicly accessible, and transparent. So that’s not a far-fetched idea. I’m not really sure what the far-fetched idea refers to anymore. But yes, that is true. That is indeed very much true. I guess, speaking of open source, have you guys gotten a lot of reports since kind of the bigger AI models started releasing their security scanning? Like, hey, I found a vulnerability, like whether it’s accurate or not. Or have you guys personally scanned the source code for? Vulnerabilities, you just… Anthropic or opening um as for the first part of the question I I know of at least one kind of report uh I’m actually I believe it wasn’t necessarily a report about security but I believe it was a feature paid uh feature patch that was just entirely vibe coded and that just waste our time right um I I would assume that for sure we we have gotten reports about apparent security vulnerabilities and then you know just ended up being sloped um as for the second part um yeah I’m sure I’m sure some of the devs have done that at least in parts um hey you know it’s it’s worthwhile to just keep up with the times I guess um and and see see what it outputs and hey Maybe some kind of LLM or AI, whatever you want to call it, does output something useful and you can work on that. Here’s a good question I got too. What is the project’s stance on anonymity? Is it a goal or is it only privacy and security the goal? The main goal is privacy and security for sure. Like we, yeah, I mean, some like usability patches and features, sure, why not, right? Put them in the mix. But it circles back to what I said earlier on in the stream, when I mentioned how anytime you add any kind of feature, you need to see, okay, how do we maintain this going forward? And that is just a very delicate balance you need to keep in mind. Like someone from a community could write a patch for any kind of feature. You know, actually, let’s take as an example, a patch to hide the white pill, right, that tells you that you’re using gesture navigation. I’m sure, I mean, I would also like to hide it, admittedly, but somebody could write a patch for it. And that’s all nice and fair. But you seem to make sure that it continues working in the future. So that’s pretty much always what it boils down to. But yeah, I mean, security, privacy, definitely the cornerstones of what GrapheneOS OS is about. And I think too, when it comes to anonymity, you know, it’s a great goal, but I think a lot of people who say they want to be anonymous underestimate the amount of effort it actually takes a constant effort. Oh, yeah. To make sure you are anonymous I’m not going to say it’s impossible but to function in daily life I think it is impossible like if you plan to have a job or live somewhere you know it’s also expensive to be anonymous if you want to get a house to see or it’s yeah yeah for sure that um yeah I mean it’s not something I’ve ever personally attempted um because I mean my my personal friend model doesn’t really require it but that’s that’s actually a good topic as well like um unlike the topic of maybe also privacy fatigue where people overdo their setup um let that be on GrapheneOS or just like in general they go through like all these lengths to do this and that and improve their privacy just a little bit like negligible amounts but like at what cost right like what is the price we pay and you know at some point you need to ask yourself is this worth it you know in the context of GrapheneOS uh I’m glad that we can talk this talk about this I feel like like profiles right um that is something that people discuss all the time in our chat rooms on Reddit in our forum there’s like pretty much a thread about like someone’s like set up like every day there’s a new friend and I I don’t know I’m getting the impression that a lot of people over complicate their setup right they have like like a million profiles okay and they’re just like compartmentalizing uh like 10 different apps but then they they don’t necessarily like have a foot picture or necessarily understand. What benefits this brings you and so I feel like they’re kind of just making it harder for themselves when I feel especially in the beginning okay I feel like my recommendation at the beginning like if you just start out on graphic os and you don’t really know what you want for like immediately just run one profile like the owner profile so whatever you want there and just relax with it don’t try to overburden yourself with all these elaborate like profile setups okay like um profiles can be useful but I don’t know the my impression is that people maybe focus too much of them and they they make it harder on themselves and I’ve very little action benefit yeah yeah and I’ve heard from quite a few people who are not even using GrapheneOS they’re just for months still planning out how they’re going to set it up with users and private space oh god yeah I’m like just get started see how it is don’t do that man don’t try and be perfect no yeah like like it’s and again like to the topic of you should like if you’re gonna run price invasive services or apps do it on GrapheneOS than anywhere else um just yeah just don’t do that right like just go ahead buy your Pixel already flash caffeine or just use it already like it’s it’s it’s that simple um because um there is no right or wrong in that sense like you know for us um like the the team you you can be someone who does not rely on Google Play for example and. That’s cool okay awesome you can also be someone that does rely on Google Play you know what that is also cool like great you know there’s no real difference in a way you you can definitely make the point that it’s probably a good idea to try to or like try to not depend as much on for example Google Play if you can and if you want to then yeah go for it absolutely it’s a good idea but if you rely on on on like the Google suit of apps like I mean just take linus from ltt like he’s just not the kind of individual that can get away with a you know de-googled setup and that’s okay that’s why we have sandbox Google Play that’s where we have all the solutions for you to use Google Play in its sandbox state and you get like all the benefits and with very little of the disadvantages of Google Play right can I just mention how brilliant the idea is to sandbox Google Play like I found that I did brilliant when I first found out about it yeah the benefits you get just from because I know people like oh if you’re gonna install Google Play then you know you failed but the fact it is just a normal app when you install it it’s wild how much of a privacy benefit you get just from that even if you use it the exact same as a stock Pixel device yeah it’s helps a ton yeah but also my impression is um I would assume that um you know people generally also like instead of YouTube maybe they use new pipe for example right like YouTube. Replacement sure cool um but you know maybe that sort of type of of um user does still rely um you play one way or another so you know what if you install Google Play for example in the owner profile. But still use new pipe instead of YouTube and instead of Google maps you run I don’t know organic maps or any of the other many alternatives okay um and so you get still so much so much of of like Google Play like the benefits of Google Play but like what do you like really lose okay like you get push notifications I mean okay admittedly with push notifications uh you know you know you need to see how these apps handle push notifications um but in in general you get so much improvement on the privacy front without losing much and that’s just kind of a balance you need to to look you need to look at your setup and see is this privacy benefit worth it to me in relation to how much usability do you lose right so someone says I assume q and a will resume soon okay maybe maybe we should take some some questions again I don’t want to feel like people this is just rambling all the time. There’s a comment here it says took me a long while to get GrapheneOS and the whole time I was planning things out I was very ignorant back then oh yeah you just didn’t know and you were probably um swayed by all the people who have like extensive setups and like to be to be fair or to be clear it’s not illegal okay for you to have like an extensive setup like a complicated setup you can you can do that totally fine you can run GrapheneOS without Google Play Store or only open source apps or like whatever you want like it’s all okay but like that’s the point it’s it is okay to not always do the perfect decision when it comes to your privacy um it shouldn’t be a zero or nothing approach. I see a question here um hold on where was it I keep getting mixed up here a little bit between the the Discord chat and Matrix I I saw a question that asked how many full-time like devs we have um I can tell you that the number keeps changing you Because we are like actively hiring, but it seems like a lot of people. It’s at least 10, but in practice, it’s more than bad. But honestly, I cannot give you the exact number. Oh, someone here asked, how many user profiles do you both use on GrapheneOS? For me, I use a total of three users. But when I set up my new device, eventually, I plan to use two users with a private space in the second user. So that’s what I’m going for. Yeah, I think I have like three, maybe. Yeah, I have currently three. I don’t really use the other two too much. Like, for example, I have a profile, because I’m one of the maintainers for this banking list, right? And so I opened this profile. Bye-bye. Where I have Google Play installed and then I’ll just go ahead and download install random banking apps from like random countries to see if they run or not so that is one of my one of my profiles where I just install banking app quote unquote junk for example. Like profiles can could be good if for example you intend to run a profile that is mostly like devoid of like Google like for example maybe you want your main profile to be without Google Play but you do rely on some specific apps like one or two that do need Google Play it can make sense to uh yeah to have a secondary profile where you run Google Play in that profile. But yeah don’t uh don’t over complicated okay I got a question here is the project actively looking for other phone companies to collab with still or is the Motorola one taking up enough resources as it is um yes that that’s pretty pretty accurate in that I mean other OEMs and other other companies are of course free to reach out uh and we we see what we can do but for for sure our resources are spread thin in a sense that of course we are heavily focused on Motorola. Going back to profiles so I know one reason for using separate profiles is that any app in a specific user can list the other apps in that user is there any plans to kind of have a toggle for that like don’t allow apps to request the list of installed apps? Yeah, it would be nice to have. I’m afraid there is many ways that an app can find out what other apps you have installed. So I guess this is probably perhaps something for the IPC scopes. The IPC scopes is a very complicated feature, as I said. Yeah, I mean, it would be nice to have, and I’m sure that this is something that would be nice to have for sure. But it’s difficult because you need to make sure that nothing leaks. Because if a feature doesn’t really work, then you can block three out of four pathways, but if there’s a leak on the fourth, then the feature isn’t very useful. Unfortunately yeah so got another one here about Motorola how to make sure Motorola isn’t occupying or infiltrating GrapheneOS Motorola has a Chinese mother company and Motorola stays under the FCC Motorola isn’t fully owned by the Chinese state however and you know Motorola isn’t infiltrating GrapheneOS in any way like we remain separate entities like entirely we we just kind of help each other out and that’s pretty much the extent of the partnership it sounds rather simple of course it’s bit more complicated than that but yeah in practice um in practice you know we of course also want an alternative to the Pixel lineup like pretty much the whole community does uh Motorola can provide this alternative and Motorola can also benefit from our expertise um and there you go you know perfect matchup essentially. Yeah and I guess going back to private space and users so someone asked how do private space differ from users security and privacy wise a private space is essentially a secondary profile. Um Josh help me out here uh I believe. I believe there was something about clipboard sharing. Could you share the clipboard to the private space user? Yeah, I think by default that’s enabled. You can disable it, but that is one big benefit. That’s kind of nice. Okay, yeah. I believe that is pretty much the only difference from a usability perspective. Well, I mean, from a usability perspective, yeah, it’s just more convenient to access, right? Well, I guess technically you could install apps from a user to a private space. You can’t install apps from a secondary user to another user. I guess that’s another usability. Yeah, that’s true. Yeah, so there are these kind of smaller differences. Add a feature to disable clipboard access or make it one way or another. Number yeah exactly yep yep yep yeah lovely thank you I remember something about the clipboard. Yeah I think we touched just more convenient and secondary I think we touched on this earlier but another person asked what’s the recommended backup solution for a tech illiterate family member using GrapheneOS is seed vault kind of the recommended route currently. Um difficult question because seed vault might work great for one person and for the next it could um not do its job fully um I yeah I’m afraid that I mean I I do also agree that backup solution we need a much more robust solution but I would say you But they should absolutely still use it, especially if they’re not that tech-savvy, for sure. Yeah, it’s one of those things that’s tough, too, to recommend because you want backups to be reliable. So if it doesn’t work when you really need it, then… That’s not great, right? That’s not a good backup. A backup is only a backup when it actually works. Exactly. No, but I mean, as I said, I don’t want to downplay Seatball too much because, as I said, as far as I’m aware, it’s been doing much, much better. So, yeah. Is there anything indicating that the Motorola partnership might bring some more features to GrapheneOS, like Google Wallet, where it might be easier to get approval at a higher level, or I guess allow listed for… Whatever is currently being blocked? Well, NFC payments for like Google Pay or is it called Google Wallet now? That is tied to Play Integrity API, right? And like even with Motorola support,. Like GrapheneOS is not going to pass through these higher verdicts of Play Integrity because we would need to license the Google Mobile Services, for example, the Google Play Store. And GrapheneOS also doesn’t qualify as Android, right? Like you cannot legally name GrapheneOS Android because it also isn’t. It is an OS that is based on AOSP with Android app compatibility, but it is technically and legally not Android. For example, we would not be allowed to have the sensors and network permission. Oh, if it was vanilla Android? Yeah, exactly. If we wanted this to be called Android, we would need to drop these features as an example. And I’m sure many, many, many more. The answer to play integrity is asking regulators from the EU, for example, to look into the issue. And until then, we need to convince app developers who do use play integrity and inadvertently ban GrapheneOS users to…To… Yeah, whitelist graph in OS for the hardware installation API. That’s the best of both worlds in a sense, because the devs can continue to use Play Integrity if they insist, but they can also whitelist graph in OS. So what happens is, you know, app ask, hey, Play Integrity, okay, it fails, are you graph in OS? Yes. Okay, you’re still allowed to pass. There are some funny occasions also with banking apps. For example, there is like a French banking app, okay? It doesn’t work because of Play Integrity, okay? Except it does, like, you can make it work. And it’s very simple. You go to the app info settings, and then you toggle to, like, block the usage of Play Integrity. And then the app works. And, like, this is not, like, the intended outcome for the app. Because, okay. You get it. Thank you. So imagine you’re at the airport okay and you’re like boarding your flight and you go to like the the like the final like check-in counter whatever where um the the employees probably like scan your your ticket one one more time okay so you go there um let’s say you are a a normal Android device okay you go there and you scan like they scan your phone and we’re like oh yes this is a normal Android phone you can pass this is fine uh option b you go there with a Pixel that has kfn os flash on it and you go there and you know your phone is essentially like the ticket you go there you show the scan via the code and it says oh no this is not a valid ticket and you denied from boarding the plane and uh but there’s actually option c okay you go to the to the counter to the checking counter and what you do is you don’t show a ticket at all okay there’s no ticket and the the employees are confused and they just let you in like they let you board the ticket the plane about the ticket that’s essentially what happens with that bank where you know if you if you block plane ticket usage like that shouldn’t make you pass through the app but that’s what’s happening so that’s uh that’s pretty funny how that’s wild just fails open yeah that just means like they just messed up implementation like straight up that should never happen but it does happen um so that’s of course very good um for those affected. Users um but I’m afraid that if the devs actually fix this problem then they will no longer work right so but yeah sometimes they are these kind of these kind of workarounds um funny short way to put it is that the banking apps need to learn from Roblox I mean you’re not wrong yeah because the faq entry I I read it it says oh you know if it meets the requirements if it gets your consistent security updates like just a whole like technical paragraph which is just so I don’t know out of out of place I suppose for Roblox of all places but hey um yeah so that’s that’s that’s funny that is that is pretty pretty wild um. Do you have any recommendations on password managers someone asked if they should just use Vanadium for passwords or something like bit warden um I mean I personally use bitwarden just very convenient right because you can access it from any device um as long as it has an internet connection of course um and as far as I know there is nothing really to um criticize like overly um I believe it is a a good option yeah for sure there’s plenty of other alternatives but um I would argue that you know bitwarden being like your your passwords being stored in the cloud is is very convenient um so yeah I would I would just use bitwarden but definitely use a password manager at the very least. Someone else recently oh yeah go um here’s a message is there a graph in those road map. I mean, not really. There’s like longer-term plans, like Motorola, for example, like moving away from the Linux kernel entirely. But I don’t think that’s the kind of roadmap that you asked for. So no, priorities can change. I touched on that briefly earlier in the stream. Priorities can change drastically. It’s just the kind of environment where you need to always be ready to react to something, right? So it’s not easy to juggle everything at once. But I think we’re doing a pretty fine job. Okay, so what’s the question someone on the stream got? Someone asked a dilemma they have. Is using a phone with friends and family, but without Palantir and other companies stealing or hacking your data and information. So me personally on this one, at least for when it comes to being more private in the physical world, I think the auto off toggles for Wi-Fi and Bluetooth are almost like a needed thing at this point. Those are two main things they’re looking for. Airplane mode’s ideal, but that’s also not functional for everyone. When they go out, they kind of need constant connection. Yeah, yeah. So definitely check those settings on your devices. Yeah, yeah, for sure, for sure. I mean, the best protection in a way is attack surface reduction, right? If there’s no way to attack, then there’s no vulnerabilities. So if you just disable like your Wi-Fi, when you go out and about, that is attack surface reduction. So yeah, for sure. That is, that is a good idea. Thank you. These settings you know if you want you can also enable the respin password um and the the two factor fingerprint authentication I just realized we haven’t even talked that much about like specific grapheneurs features um there’s a bunch yeah like which one should we talk about I mean honestly for the respin password if you’re going to use the feature look I mean listen I’m guessing that most people that are watching this stream right now and the people that will be watching this when it’s on YouTube they don’t exactly I guess have the threat model of the respin slash password but it can still be useful um you could like carry like a piece of paper in like your your phone case that you know apparently tells a thief like your your PIN or password and then they enter it and it turns out to be duress and it just nukes your phone uh like that is the kind of um little things you can do um but please please for the love of god make backups if you have I mean make backups anyway but like in particular if you have this feature enabled because um I have seen and I have read you know way too many people who have this enabled and then they you know they enable this feature because I I don’t know either you know their setup is a complicated they have like 15 profiles with like 15 different PINs um or I don’t know they get drunk or something and they accidentally input the respin password it nukes their whole phone then they come into the chat rooms to ask for help. And we cannot help you nobody can help you so please please be be careful yeah or if you have a child who likes to press on the PIN numbers don’t make it something where they can just type it maybe don’t make it one one one one yeah yeah actually worth noting maybe um some people have missed that Google has very recently updated um like the the like throttling from the secure element so now like it used to go up to like two weeks it’s a lot more aggressive now um I think yeah it it starts pretty you know relaxed but it actually goes up to like nine years of wait. And the the attempt after the nine years is just a permanent you know soft break so like I think like 20 attempts what was it you cannot attempt it again ever so yeah uh be careful out there um yeah I don’t know where the article is but I remember seeing that recently and it was almost extreme the limits they put in are very aggressive yeah it was yeah we we have an updated table on the on the website um in one of our categories there yeah it’s it’s like max 20 attempts so it’s it’s a lot more aggressive now it goes to like one year then like three years and then nine years and it’s like okay um sure sure buddy I’m gonna I’m gonna remember my password in nine years I’m sure if I just sleep a night or two I’m gonna I’m gonna remember it um so yeah that’s uh and that’s also why even a four digit long PIN is considered secure now you know if you So if you trust the secure element to do its throttling, even a four digit PIN is secure now. So before it was six digits. But now that, yeah, the throttling has been strengthened even more. It’s like, okay. So good on the one hand, and I guess maybe bad on the other, if you forget your password. Yeah. Speaking of forgetting passwords, I guess this was a trend I saw every so often, but it seems like there’s a block of forum posts that come up about my PIN used to work. It doesn’t work after this update. Have you guys found anything specific on what could be causing that? Or is it just? I know which, which threads you mean. Yeah. Most of the time, it’s someone like reviving a dead thread. And they, you know, they mentioned the same issue where they, yeah, they, you know, they type in their PIN, but one day, just doesn’t work seemingly apparently after an os update um I don’t think we know the cause um I I do know in in the sense that there is no indication that it is a GrapheneOS specific issue it could be a super rare upstream bug um it could I mean it could also be that half these people did indeed forget their pain I’m not saying that that’s what happened to everyone I’m sure some people you know did face this legitimately I think I read somewhere that um if you maybe keep the you know device turned off for a bit and then turn it back on it might work um but it could yeah it could just be some kind of hardware issue right where someone rightfully mentioned in the chat where a secure element could be on his way out one thing I do when changing a PIN code or when I set a password is I’ll record myself I’ll make sure I delete it afterwards just in case I incorrectly enter it twice all right yeah I like different device I like it yeah just to be safe because it can happen okay apparently there are reports of that same thing happening on the stock operating system so that’s what I meant that it’s it’s not really graphene ois specific issue so don’t really know what exactly. It is but I mean very small sample size right but I mean it has never happened to me and I’ve been using graphene ois for over three years at this point um and you know it hasn’t happened to anyone I I know more personally I guess but yeah you know it’s it’s it’s a computer at the end of the day and the computers are are weird like that sometimes um. But it’s definitely not a widespread issue so yeah are there any major differences between a physical SIM or an e-SIM and is one better than the other um I don’t think there are any inherent benefits I mean I guess for the I mean the benefit from e-SIM may be that um they’re like it’s not the physical like little chip that you put in your phone so it cannot get lost or or broken but um I I don’t believe there’s any like inherent like privacy benefits from one to to another it is worth noting that you’re like if you do you have like an e-SIM for example on your phone and you flash graphite os or you flash back to stock os your e-SIM does remain on the device and it should remain no matter what you flash on it one exception is the duras PIN slash password feature if you activate that that will also wipe the e-SIM but yeah under like normal flashing the e-SIM does remain I think there’s also a toggle in the os when you want to install an e-SIM isn’t there some Google code or something it requires to install it on the device because you need a Play Store maybe but you don’t anymore yeah that’s that’s that’s no longer um like applicable I mean I believe no I believe we are like we’re still using like a proprietary Google app but it doesn’t send like data to to anything I believe we have yeah we’ve definitely stopped it from sending like any kind of data like that to like Google Play for example so it is it is isolated um oh nice yeah. We also done something I mean not similar but it kind of just popped up in my mind how you can use you know Google camera like the Pixel camera app on GrapheneOS without the Google Play Store um it broke at one point but we fixed it and we just kind of stubbed it out and uh so that’s that’s useful for people who do prefer the output of the of a Pixel camera. Um here’s a question what goes into asking organizations to support GrapheneOS via device attestation many apps including banking apps have explicit support for GrapheneOS as an alternative to using plain tagger and GrapheneOS has remarked on social media that they have been successful on this front. We need the actual customers of the banks like to complain essentially right and to ask the app devs and whoever is responsible for it to add support and like on first glance it might seem kind of hopeless because like okay yes we have over 400,000 users but that’s like drop in the bucket in comparison to how many Android users are out there but it’s really not that impossible of a challenge to pull off as you know we have done it before and like the two swiss ones I I mentioned earlier in the stream is that the like confirmed cases there are also some banking apps that I don’t know if they have like implemented or like whitelisted GrapheneOS for that API directly uh you know some some banks um they they don’t necessarily say they support GrapheneOS but in practice if there’s an issue they they will fix it so take that as you will have any banks implemented device at the station for GrapheneOS of their own accord on or on their own accord without customers complaining um I think that is difficult to tell because um chances are the you know in that case the app just continues to work And, you know, if the app continues to work, there is something to complain about, right? One question here someone asked is, is it possible to set up a VPN and an ad blocker at the same time? I’m confused about the two working together. So from my understanding for that one, it depends on what type of ad blocker you’re referring to. Some do it by having a local, I guess, a VPN and a loopback address on the device. Yeah. So that does take up the VPN slot. So you can’t. Exactly. But if you have something that supports ad blocking in it, like a VPN provider in their app, then you can just toggle that on. Otherwise, you can’t. Yeah. It’s really just considering this requirement that you can only use one VPN app. So if your ad blocking solution takes up that slot, then you’re in a bit of a pickle. Does GrapheneOS ever take known spyware samples and run them on air-gapped GrapheneOS devices to see how they work in real time to be able to block them, e.G. Pegasus, Celebrite, Palantir, Graphite, etc. If there’s any documented attempt these adversaries spyware tried to exploit GrapheneOS. We do have a thread on the forum that has some, like, Celebrite slides that kind of show that, or, like, that at least, yeah, I mean, they do show that GrapheneOS is effectively immune in simple terms. They are a little bit older, but… But we do, like, get the updated slides, like, regularly. So we do kind of keep track of that. And yeah, I mean, nothing has really changed in that regard. Yeah, I mean, I just want to add, like, by all accords, GrapheneOS does appear to be very, very resistant to these kind of, you know, forensics software and this kind of advanced malware. Because the defense is layered, right? Like, you have many, many protections kind of working together. So even if one protection has a vulnerability somewhere, chances are the next line of defense stops the attack. Yeah it was great seeing that slide because it was like iphone stock Pixel something else and it was all like check mark check mark check mark GrapheneOS just x x x x exploits don’t work exactly yeah sometimes like we do see um people that like dig up like weird like super old like even the court documents or like weird um old slides or whatever that apparently show um that GrapheneOS is um or has been compromised but in practice every time it turns out that um the the owner of that of that phone ended up you know revealing their PIN slash password one way or another and it’s like yes if you give your PIN password voluntary or involuntary then I mean yes you are cooked you know um yeah how do you approach ad blocking on Vanadium I don’t see ads almost anywhere now except for Reddit and x aka twitter uh yeah we did implement ad blocking on Vanadium some time ago uh it’s based on like a filter list um forgot the exact name I’m sure somebody can tell me but yeah it’s based on like two lists I believe. So it’s not like overly complex but it does the job pretty well I would say. Um a little off topic but for Reddit for example you can uh use I mean Reddit and and twitter also have uh like open source front ends you can use uh instead of visiting the sites directly you easy block yeah yeah that’s that’s that’s one of them I forgot there’s a second one but yeah that is that is correct thank you oh no yeah it’s quite easy list yeah good point thank you yeah another question I got which I’m actually curious about this one because I think it used to be a feature for like a short period of time currently you can only use install available apps from owner is there what’s the reason why you can’t do that from a secondary user to another secondary user because I think it was enabled for a time but then it got removed for I think security reasons yes I I yes I do recall there was some kind of security issue with that approach for sure I don’t recall the exact reasoning however maybe somebody can look that up for me uh but yeah I’m a I’m afraid I don’t know the exact reasoning but there was indeed I do vaguely remember there being an issue and with that are you aware of any countries that support GrapheneOS through policies someone said that they know there was a politician in the czech republic who spoke about GrapheneOS on tv and debian. Interesting I did not know of that um I I do yeah I do see you know people that work in politics talk about GrapheneOS every now and then well they’re also on mastodon for example um it it does it does happen yeah yeah for sure uh I mean there might be a lot of these kind of people using it but maybe we’re not exactly, they were not exactly outspoken about it. Oh, I’m getting some explanations for why you cannot push apps from one secondary user to another. Let’s see. It basically could be an issue with malicious users. The old feature didn’t say the profile that had the app installed. Oh, okay. Okay. So yeah, it is. Yeah. A potential vector then. Oh, so since Android, I guess, is made to be a multi-user device, someone could then have a user push an app and then. Okay. Anyone can push whatever app to other users. Yeah. Oh yeah. Good point. Yeah. Of course. Yeah. Yeah. That’s true. I mean. I didn’t think about that one. Yeah. That’d be pretty bad, right? Yeah. I see. Yeah. Thanks for that. Thanks for everyone helping out here a little bit. Oh, here’s one if you can answer it. Where does GrapheneOS source the Google apps like Play Store and Markup that are in the App Store? Good question. Um, I’m afraid I cannot give you a good answer to that. I don’t know how exactly it works. I’m guessing they are maybe ripped from the stock OS, perhaps. That is my admittedly not so educated guess. Not so educated guess. You can do it. I know unless you’re a good sign. But, you know what you’re doing is like a good sign. Yeah, I got a note that they are probably indeed taken off a device that is running the stock operating system. That makes sense. Yeah. Yeah, markup is weird because it’s, for some reason, it’s not offered in the Play Store, so we have to host our site, which is kind of strange. But it is what it is. Also, go ahead. I’ll try to remember it. Do you have any opinions on pass keys in the OS? I’ll just quickly give my opinion on pass keys. I don’t like pass keys since they’re tied to a device and I can lose my device. I prefer hardware keys, like a YubiKey or something, but I know that pass keys are being pushed for convenience. Convenience and so the person’s questions are like is there a plan to incorporate them more into the os natively or just use an app I guess that can hold them for you okay um yeah I mean I definitely agree with your sentiment joshua um yeah if you just kind of cruciform they have to be a bit unfortunate um not aware of any specific goals for that no. I I don’t I don’t believe so you mm-hmm um yes I mean yes it it it does sound good on paper um. And I mean the oral store has made some improvements in like their like security wise to like make sure that the apps you download from the oral store are actually the apps you want to download um I believe it is still not quite on the same level as the Play Store however and uh problem is with the aurora store is um it doesn’t like you always need an account to use the Play Store and it doesn’t change with the aurora store just on the aurora store you’re given a dummy account and you know that is a violation of the terms of service And it often is overloaded with users and then you log back in, try a different account, try a different dummy account. And so I believe you get rate limited relatively often. So yeah, it’s, it’s not quite on the, on the cellular, the, the, the Google Play Store, I’m afraid, but there are some like really strange, um, edge cases where, um, with your oral store, you can actually download an app that, um, is kind of set to, um, because you can, you can use the play integrity to, to stop an app from showing up on the Play Store on apps or sorry, on phones. That don’t pass play integrity right um and aurora store kind of just ignores that restriction so you get to install that kind of app and sometimes it’s again kind of a weird setup with play integrity so you know they might enforce play integrity on the app store listing but then when you download and install the app try to run it it actually works because there is no plan to go to check inside the app um so that is one of those really weird edge cases um where aurora is I guess in a way superior but yeah most of the time uh you’re probably better off using the the Play Store if you want like the best security security and it’s also worth noting that um all these like dummy accounts let’s just get banned by Google right it’s just not a very um. Like reliable way of accessing the Play Store I’m afraid yeah it works well until it doesn’t unfortunately yeah and it’s also like the fact that um the oral store will also not have the same app compatibility right because some apps also check where they were installed from um for example um it doesn’t really have like play asset delivery so like overall compatibility will generally be worse than the Play Store but well uh it is admittedly also pretty difficult to compete with the original Play Store right in that sense like the original place that will always have the best compatibility I mean that is why you can install it and it’s in a sandbox state if you want. I heard the goal is to come away from the linux kernel to a microkernel is this a goal in Motorola devices for long term two that is very far in the future. I’m afraid like that is just too far in the future to to really comment on that but yeah the first sentence does does check out. Good question here which stock apps will be replaced or modernized? Pretty much all of the AUSB ones. So let me just quickly check here. I’m on the phone here. So it would include the clock app, contacts, I’m guessing files as well, gallery, absolutely. Yeah, the messaging aka SMS app. And I’m not sure about the phone app. I mean, that appears to be working decently well, but maybe, I’m guessing there’s going to be some updates across the board. Also, have you guys played around with the updated PDF viewer? You can finally, like if you want to change pages, you can just kind of swipe, so that is very nice. It’s very hype when that update when we push that out yeah it’s it’s a huge uh usability improvement that was a pain before yeah yeah for sure I I do have to agree unfortunately what about calculator um I mean probably yeah I I didn’t I didn’t really get told what happens to calculator uh it’s relatively far down in the list right um for for many reasons uh but yeah I mean as I said I’m guessing all of his apps will get a facelift one way or another. So someone asked I guess going back to the aurora question so is installing play services and using Play Store the official recommended route you um if you need something from Google Play yes yes we we do like this official recommendation where you you better just use the Play Store. What’s the biggest security weakness in GrapheneOS that the devs want to improve on currently. Oh that is an interesting question very thought-provoking definitely biggest current security weakness um so from what I’ve gathered the biggest security weakness really is the linux kernel um I’m afraid so but that is difficult to um fully fix right I mean there’s there’s some things you can do there’s some there’s some tweaks you can do to the kernel um there’s features you can sort of disable and remove to remove a bunch of attack surface but the kernel does remain a relatively big attack vector. Oh and going back to the install available apps question the person that asked that clarified they’re wondering if let’s say you install an app in a secondary user if it would be possible to make it so that owner could install from that secondary user because otherwise you can’t really unless you directly installed an owner you you can’t get that app across if that makes sense no I’m not sure sure I follow so they’re installing an app yeah they’re installing an app in a secondary user and then if you go to owner you’ll see that it says this app is installed for another user would it be possible to make a toggle to let you install that app in owner since if you’re owner then you should have permission necessary because currently you can’t you have to manually install it in owner um I thought about that yeah indeed same here maybe um it’s a little strange because apps are installed like phone wide right okay like they’re not necessarily available in every every um profile but they’re installed everywhere at the same time which is also why if you update the app in one profile it should be updated in the other as well um that is yeah that is also a very thoughtful question um perhaps I I suggest maybe look through the GitHub tracker like the issue tracker on GitHub um see if maybe somebody has yeah come up with this idea before and if not maybe consider uh yeah filing an issue there. Any future thoughts on making graphene was its own desktop operating system I know desktop is not a it’s not as secure overall but it would still be nice. Um well you see there’s there’s many things that we would love to have um that pretty much sums it up unfortunately um well I mean there is the Android desktop mode right um but hey I mean who knows if there is suitable hardware. Why not I mean there was also talk about a sort of like a Pixel book or like a kind of laptop by Google and I was I believe supposed to run Android at the end of the day um you know if that ever gets released then it does meet our requirements when chances are we can support that but yeah that doesn’t really quite answer the question um let’s say we have our hands full with the current um the yeah the current circumstances you with this one going back to the kernel so you mentioned the biggest security weakness is the security of the kernel and I do see that it is frequently exploited what about the closed sourced boot chain they asked um in detail what do you mean with closed boot uh the closed boot chain like do you mean the closed source like proprietary like firmware for example they said when rebooting the device you will see the hash of the os image which will betray the state of the device uh yes but that’s just verified uh boot doing its its its work right. Yeah I’m a bit confused by that question yeah maybe we can you worded I think I also didn’t quite yeah I see the message you have now I’m talking about the proprietary initial bootloader when talking about the boot chain. Propriety okay I mean well yeah I mean you know that is all kind of in the firmware and we can’t really change the firmware in that regard but there’s also one of the requirements that the firmware is updated regularly yeah can’t do much about that on the Pixels. But as far as I understand for more you security on the Pixels is pretty good and I mean Google has like we cannot really like change the firmware on our own but Google has changed the firmware for for us in a way based on our suggestions in in the past so so there’s that I remember a while ago uh mentioning there might be plans to implement an anti-feft feature that lock the device if sense being snatched out of someone’s hands like there is an Android but it would be it would be a graphic or a specific implementation it’s just in the pipeline. Um yeah someone mentions there is an issue on tracker mission that is max priority okay yeah I mean yeah I would say you know if if the issue is open if it’s got a decent priority then it’s on the radar then at the very least it’s something that you know the devs consider to be a useful feature and on the topic of the issue tracker and kind of um jumping back to a previous talk we had here on the stream uh something I noticed that um like also on the on the internet people say we uh we’ll just like delete uh issues randomly or comments on on our issue tracker and the answer to that is just like you know if if you’re being rude or like super entitled then we simply don’t have to put up with that like there you go and so in that case yeah we will delete comments or maybe even entire issues if you are uh not being nice there you go to put in the most um nice terms myself um you know if if you’re like respectful then we will also be respectful. Yeah sometimes there’s this impression that an open source project is the equivalent of someone being angry at an Apple support employee but it’s much different yeah like a lot of open source projects I’ve seen some where you’ll have a open source project a corporation is dependent on and the corporation will open an issue and start complaining asking for stuff and it’s like well you know you’re getting this for free there’s only so much And it’s, it’s kind of odd and funny and also good in a sense, because, um, and actually this is something I’m like happy about is that, um, like we will absolutely, um, like we, like we, we support like everyone in the sense of that, um, even if it’s like just one seemingly random user who needs help or need something like specific explained, like we will indeed like take care of that user, um, and even like, like given in-depth, like technical explanation, for example, um, like we, we will do that, but it’s like, we’re happy to do that. Um, you know, that’s, that’s our passion is a project driven by, by passion. Um, but it’s sad, like if, if you’re just being rude or, or, or anything like that. Then we, we just don’t need to, yeah, just, you know, we, we don’t need to do that. So, and like, we just want, um, yeah, yeah, it’s, it’s an interesting, um, setup, right? Because it’s like, um, this whole, like, I guess the graph, you know, ecosystem in a, in a sense is, is, is unique in a, in a sense that like you have, I don’t know, like a typical, uh, Android phone and like the, the support from any of these like super large companies or, or Apple. And like, uh, in practice, like getting help from like a real human is, um, like closely impossible. And you’re just being shoved around in like FAQs and, uh, probably AI chatbots and probably AI chatbots like on your phone. And you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re just, you’re well um whereas here you can just join the chat rooms or the forum or our Reddit or wherever and get help pretty much around the clock so that’s nice and that’s all for free there you go yeah it’s pretty unheard of isn’t that lovely. Now here’s a nice uh not a question but uh something someone wrote not so much a question but I love how informed whoever runs the twitter slash Reddit accounts is on other projects like the other linux phones and eos I always enjoy the twitter smackdowns they do okay yeah I mean yeah yeah indeed um you know some of our uh devs I mean some I’ll give it all of devs definitely know what they’re doing uh but yeah there’s um um people in there they are clearly very very very good at their craft um so yeah yeah twitter account is like the general graph, you know, as I kind of shared, but most of the time I can kind of tell who is saying what, because it depends on like the time of the day. I can kind of guess who is saying what. But yeah, it’s pretty, pretty cool. Yeah, I mean, that’s the thing. Not everyone appreciates that. But the truth is like, we don’t, we don’t sugarcoat things. Okay. Like, because like educating people about, I mean, I don’t want to say like real privacy insecurity, because real privacy security depends on who you ask. But like the privacy insecurity that we think is real. Like educating people. About that um is it’s a it’s a major role of of of what we do plays a major role um so we we don’t really sugarcoat things and I guess sometimes that does um upset people occasionally um so yeah but you know there are um ways you can vegetate that yeah part of the issue too is the more popular that privacy and security get as a trend the more you get people coming in who want to make a buck off what’s been done and so they kind of launch their own products that is such a great topic I’m I I love I’m really happy that you touched on this like the amount of like probably like almost every day okay I I I check like graphing or socials I’ll check like our chats and then I I I come across some random like os that is based on GrapheneOS and that is clearly just trying to piggy bank of our success okay some random os and turns out all they do is just bundle some some apps and then yeah they they bundle some apps they bundle some um some some kind of services some like gimmicky features call it an os slap a price tag on it most of the time it’s even a subscription and then sell that that happens so often and like people can do that like the permissive license does allow people to take GrapheneOS do their own thing and and sell it or sell straight up GrapheneOS like people do that people can’t do it um yeah it happens so frequently and like the truth is like there is simply nobody else that um does the work we do and especially not these like very shady looking forks of graphene. OS okay yeah just don’t yeah just don’t don’t even no just just don’t there you go that’s that’s my response um yeah like GrapheneOS kind of plays on its in its own league um in in practice I mean okay I guess like stock Android and like stock Pixel OS and like iOS also like admittedly are pretty like in that league I suppose or at least the closest um but um yeah and uh it’s what yeah what also happens is because like um we are so good at what we do um it’s happened that um you know sometimes we call out these kind of fishy products that are just out to like startup scam you okay and you know of course we’re not going to make friends with these people but we also don’t want to be friends with these kind of like entities um and there’s many examples I could I could bring here um but like just straight up scam products um. I’ve seen some replies that are like oh well why don’t you just help them instead and make them better and that’s such a big request to tell or to make it’s be like I’ll just help improve their product that’s like it’s tough enough maintaining one os let alone helping improve a project to bring them up to the same standards I don’t know it’s just some of the comments I see on those those threads that pop up um yeah but you need to differentiate between like you like a literal just scam product that, you know, the creators clearly don’t actually care about. They’re only after your money, okay? Like, always follow the money, essentially. Like, that’s not going to do anything. It’s just a waste of time. And we also don’t want to, like, be put in any kind of connection with these kind of companies. Just don’t. They always advertise, like, military-grade encryption and all kinds of, like, just ridiculous amount of, like, buzzwords. But I don’t know, like, what do they even mean? Yep. Yeah. There’s been somewhere then they go and do, like, an interview, and it’s like, what are you even talking about? Yeah. Or they just have, like, paid sponsorships on, like, various YouTube channels and content creators. And then… You like watch the video and and they’re like uh they’re advertising like uh like a dns block list as like the holy feature and they they show how look how many trackers we’ve blocked and it’s like bro like this is just very simple dns blocking that you can set up literally in two minutes like you don’t need any specific knowledge and that is really not a crazy feature but um yeah I mean unfortunately some people who are just not very tech savvy um get sucked in that and and believe these claims um and you know most of the time we just leave them alone uh but yeah sometimes we will kind of go ham on them when they just spread lies about us and the project if they say oh look oh you know graphene is actually a good project but look at how good our project is like and then yeah that like good luck because we will absolutely obliterate you on a technical level completely and you will not survive that encounter um yeah and like I I do find that is totally fine like as harsh as that may have sounded just now yeah like I I don’t know why we should give space to just outright scammers I’ve been seeing some posts where they’ll use like a block test site and they just reverse the domains that are blocked why isn’t GrapheneOS blocking them actually here’s the full story you know it’s just kind of debunking those yep those those facts yep yep yep yep it is really sad to see um I I hate those so much yeah. So I mean honestly like if you like don’t have a Pixel or or you know like we we also have to keep in mind people who live in countries where Pixels are not sold okay and importing Pixels are super expensive um in that case well you can’t really use graffiti OS but in that case we would just recommend you to either stay on the the stock OS or I guess go and switch to the natural ways if if a device supports it um because I guess on an like end-of-life phone um you know that doesn’t receive further updates um I suppose lineage OS would still bring some like user space updates um you know it’s not saying that is that it’s a very good idea to use bad but uh sometimes you kind of have to work with what you have um. But uh yeah I guess on that line of thought question about what does GrapheneOS think about the pal moon browser so I guess that could be a general question isn’t that just a Firefox like yeah it’s a hard fork from Firefox so I guess maybe just a general question about Firefox forks in general kind of what’s the opinion on those kinds of browsers um so first of all Firefox not exactly a very secure option especially not on Android uh it’s it’s really far behind on on Chromium uh like behind Chromium um so it’s just not a good option in in general um I I recommend you to search for like Firefox uh like keywords on our socials and maybe even on on our Discord for example uh it it doesn’t do very well in terms of like site isolation as uh you of similar things of similar nature and I mean this pale pale moon browser I mean it’s probably very niche and so um it may also lag behind on on updates um which is not good uh you know if you’re gonna fork a browser then you also need to stay up to date with a fork. Uh I I don’t I I I mean I’ve not looked into it right but a is Firefox b it’s probably pretty niche um so probably not not the best option from a purely objective standpoint. So it says my phone died and I just went for a walk while it was charging please don’t say I missed some kind of cursed desktop os discussion um I mean we did have some desktop discussion before it wasn’t particularly long. All right here’s one that I’ve seen come up a few times as well what is GrapheneOS doing or going to do when Google makes AOSP closed Google cannot be trusted would GrapheneOS move to a model similar to what pure os did with their phone. Um I don’t know what model this pure os is going for but there is no indication that you know Google is closing off AOSP in that regard you And we do have a Motorola on our side now, which should help with that or any other kinds of weird shenanigans that Google might be doing. Because I feel like on the Hakuka side of things, things change very quickly recently. Yeah, it would be interesting to know what this other OS has in store or what it’s doing. I think people also forget too that Android has run on more than just phones. So for them to close off Android, it’s not just against GrapheneOS or some other projects. It would be like every device, car, TV. Yep, yep. That is indeed also true. I think people vastly underestimate what it would take for Google. To be like yep yeah we’re closing this off here’s an interesting question what is a common recommendation people give to GrapheneOS users that is very wrong um let me think about this for a moment a common recommendation okay so people that are non-graphine os users that recommend things to actually graphine os users that is very wrong that’s how I understand it um. Interesting josh do you have any thoughts on that like yourself. I think uh I guess this also touches on another topic but the fact to avoid Google at all costs and if you use open source then you’re safe I think is yeah yeah that is a good point too that’s a very blanket statement that has a lot of nuance to it like just because you don’t install play services because someone recommended it doesn’t mean an app is not bundled with Google code inside of it yeah function yeah that happens all the time it happens all the time like apps are bundled with the Google libraries all the time yeah for sure I mean I would also say like like rooting your phone using like shizuku I hope I pronounced that right um like tinkering with developer options um you know changing system apps permissions or like disable mentality like just don’t do that in general do not touch on like do not touch like system apps you know go ham on like any apps you install yourself you can just do whatever you want for those but just leave the system apps alone they’re trusted um just leave them alone. Uh probably in a also more philosophical aspect that is a good point uh they say that grapheneurs is security first and you know essentially privacy second and that’s just not true from from our perspective um because our perspective is um to achieve privacy you need good security because if you know if your phone is not very secure then you you can argue well the privacy aspect is kind of falling apart then so that is why also a lot of the work we do is also security but at the same time there’s plenty of actually like straight up face-to-face privacy features use context scopes for example sandbox Google Play so there’s there’s plenty of that someone else mentioned that using F-Droid for everything is another uh yeah getting spread. Um yeah I mean yes I mean sort of like yeah because you see I mean f4 sounds great on paper um great open source apps but then probably start with like they’re building infrastructure like suddenly running on like an end of life uh like devian server for example uh like they’ve been released I mean they’re weird like inclusion policy um the like the the the as slow app release like updates update schedule there is a lot you can mention for F-Droid which kind of need to be approved upon ideally. I saw some people saying GrapheneOS is the most secure os but they don’t use it because they don’t need that high level of security. Yes but I mean. Like everyone you know needs one’s security whether they know it or not um I think these people. Don’t necessarily like know that you know whatever phone or whatever setup they’re currently have running is probably pretty awful to be honest you I think it’s also tough to explain because if I lock my door in my house if someone breaks in or if I leave it open I know that happened saying you don’t need security and kind of the cyberspace you don’t really know something’s wrong until it’s really wrong yeah so to say you don’t need it’s kind of difficult I guess to say yeah yeah for sure as we have a we have the official graphic news account posting right now I say many people greatly underestimate the importance of the privacy and security improvements it makes yeah pretty much so it goes back to people who don’t yeah who don’t really have or understand the the whole picture. Because it’s also not something that um you touch on often right like there’s not there’s there’s just simply not many projects that that take security seriously oh here’s a question going back to the secure element could an attacker wait for a vulnerability in the secure element to access the device in before first unlock since the phone wouldn’t be receiving updates if so would GrapheneOS consider an optional setting to purge the decryption key from the secure element after an amount of time similar to auto reboot. Yes so I mean yeah that is true um in theory you you could wait or try to develop a secure element exploit um you know as far as we are aware that has not happened so far but yeah in theory yes if you if you hold a phone your possession for for enough time which is not updated eventually you may come across a vulnerability and you know if if you feel like that is in your threat model if that is something you want to be safe from um there are some features that are already in the os that kind of help like the recipe and password um that you know will nuke hot civil encryption keys and other like critical data um and the you know the mere presence of this feature existing um kind of just scares away you from like entering random PINs right because you might you might you might hit the duress one and then your all hope is lost on on recovering but the data but also we like this is what our um like the two factor uh fingerprint unlock is is used for where um so you can kind of use you can kind of rely on the secure element to do is throttling um or no sorry I I completely messed it up um where you do not do that in fact where you use like a master password for example so you know you reboot your phone uh your phone will always ask with initial password uh so that is like your primary unlock and that can be pretty much anything you want that can be just a regular PIN so you fully rely on the secure element but if you don’t want to rely on just the secure element if you’re afraid. Where you could get breached in the future that is a new threat model then you will just use a sufficiently long for example passphrase or a password that is like 20 digits long um and that will protect the contents of your like phone even against a brute force attempt right like at least so far um it is not really possible to to brute force that um so even in the event that the secure element like throttling gets bypassed somehow in that case like your password would still kind of protect your your data and then you can use it to to factor fingerprint unlock to still have like a like in terms of usability a massive improvement um because you can still for like your secondary unlock you can then use your fingerprint and then additionally a PIN um because you know if you only have a fingerprint then that is a little risky because well your finger you somebody can just hold your finger against the phone and unlock it. Whereas with the two-factor fingerprint unlock, they would need your fingerprint as well as your PIN. And then you couple that with the auto reboot feature, right? Which puts your phone back to the BFU state, which is the most secure state your phone can be. And then it would ask you for a master password again. So you can see there’s a bunch of kind of features that work together to make this kind of cohesive structure. And yeah, try to cover all tracks in a way. But yeah, it really depends on your use case, your threat model, what you’re afraid of. Like in practice, most people don’t need to be afraid of the secure elements. Meant being breached like right um but hey if if if you are afraid of that if that’s in your threat model or even if you’re just interested in in in like securing your set from bed you know the features are there um play around the settings see see how they they all kind of interconnect. I think talking about the encryption as well you know correct me if I’m wrong but the PIN code or password used to set on the device is then used to derive the encryption key so it’s not like a four-digit PIN means you have a four-digit encryption key no no no it’s it’s part of the like process yeah like someone tries to force the encryption it’s it’s much more protected it’s not just a five-digit yeah yeah yeah there’s there’s a bunch of um things that go into that so for example also when like if um before if encryption keys are destroyed like you use duras PIN everything gets nuked even if like if that happens and even if the attacker for some reason knows your PIN slash password it doesn’t matter anymore they still cannot decrypt it oh because you can’t re-derive those encryption keys at that point in time anymore so the data is destroyed because yeah yeah there’s just a bunch of factors that go into it duras PIN just nukes everything and then yeah duras PIN is very I mean it’s it’s not like it’s I mean it is a simple feature in in a sense of what it does um and it is kept simple on purpose right because it obviously always needs to work so any complexity um could work against that so that’s why we don’t really have much of a like you know option menu for the duras PIN slash password. Would having unfettered access to the data and the secure element give you the decryption key or would you still need the PIN slash password to get the full key someone asked um yes I am I’m pretty sure that is accurate in the sense that like you do still need your your PIN slash password how to access it the decryption key yeah. I I would recommend to read the there’s a section of that on our website that talks about like the encryption in particular how long should the device pass you phrase B minimum I mean if you don’t want to rely on the secure element faultling I believe there would be like six to eight words like if you’re using a passphrase I believe that is still up to date and if it’s like truly just a you know random jarbled mess of letters and numbers for example it would be about 20 characters I believe that it that like that makes it so you have enough entropy to resist even brute force attacks yeah. And like doing that will provide like encryption on every any any kind of like phone or like or like regular drive right if you encrypt it with a sufficiently long PINs password passphrase But it’s not necessarily very convenient to type in, especially on a phone, right? So that’s why we use Pixels that have the good, that have the fortly included. That’s why we have two-factor fingerprint unlock. I use like a 10-word passphrase and I kind of dread reboots now, but it’s a nice peace of mind. Yeah, yeah. Yeah, like that first reboot is going to be a little painful, I suppose. Although, I mean, I guess you could maybe use like a keyboard to type it in, but yeah, it’s not the most like perfect condition usability-wise, but that’s just the kind of trade-offs you have to make sometimes. Yeah. In general, like we strive to have like the best combination of like privacy, security, and usability, and like the out-of-the-box settings. Because there are ways to… Where do you think that’s okay? Where are we going from? I’m going to show you what I’m going to do. Like harden in a way the os fervor with like with the included toggles um. But yeah a lot of them are not set by default or some of them some of them aren’t I was actually curious about that when you guys so I think memory tagging is off by default if I remember correctly for user installed apps yeah do you guys do that is it kind of like how many users will this cause issues for versus the benefit or is there a time where it’s like it’s worth turning on by default is there like an analysis that goes into that at all um yeah it’s just it’s just sort of like an assumption or like a like knowing how many apps out there that have some kind of memory corruption bug that will be detected and thus terminated by memory tagging and then seeing well okay that’s that’s not great if people cannot use your apps because like okay in an ideal world you wouldn’t need to use the app but in practice maybe you do need to use a buggy app um so yeah that that does also play a role right um you can for example also with our like the usbc settings um you can even turn off the usbc port entirely um or use it for charging only but that is not the default because it’s just not um what I guess most people would use it for because a lot of people will connect the phone for something that isn’t just charging like to a car for example or whatever um so so the default is uh pretty useful there somebody made a good point that the encryption keys are derived but not stored when a BFU state there is no key to obtain yeah I believe I believe you’re right. Yeah yeah. No I’m still looking for Discord I’m sorry sometimes I go on these on these ramblings um all right let’s see uh what else is here. What are your thoughts on badness enumeration is it completely useless not as a convenience feature but as a tool for your price and security. It’s I would say not the end goal you Because I’m sure there’s plenty of papers and written sites that kind of go into detail about badness enumeration and why it doesn’t actually work in practice or is not very reliable or you should be reliant on. Is there a plan to support face unlock in GrapheneOS or is it considered less secure than other options? It can be fine if the Pixels still had the appropriate hardware for it. I believe, what was it, the Pixel 4 XL, I don’t remember, but one of the Pixel 4s had like special like camera uh hardware that allowed an actually secure face unlock and that is since missing from like modern Pixels and that is also something and that is also why face unlock is not a thing in GrapheneOS. Yeah I think then with the older device it could do like a 3d image almost I think they’re like stereoscopic or something I forget the name now it’s just a camera which is not ideal for that yeah it’s it’s just not yeah it’s it’s simply not secure you know it can be most definitely tricked and you don’t want that um so yeah not even mentioning like pattern unlock right like that it’s just horrible so it’s also out removed. What if you rely on the secure element how long then I mean if you rely on the secure element with the updated changes even the four digit long PIN um is secure right um and so like if you do rely on the secure element like adding much more beyond that isn’t very useful I would argue. Because if you see if you do something kind of in between where it’s not really enough to withstand prolonged periods of brute forcing in an event that the secure element does fail you you might as well have just used a four-digit long pinband, for example. Here’s an interesting one. Will the Motorola… Go ahead. Is there any preference by the project on either a hardware or software solution being preferred? So like Lux encryption versus a secure element? Like is one better than the other? Yes, I mean, the secure element has been tested under various conditions of trying to like break it and break the throttling et cetera. So yeah, yeah. I mean, I think it’s maybe a little bit difficult to to come to come. Hair I don’t really think they both fit the same use case if I understood the question correctly yeah I think it’s more just which one’s maybe more reliable if there is one hardware versus a software security sort of thing I mean having actual hardware to to back it up is definitely better especially for some like a secure element like frottling unlock attempts for for sure. Uh will the Motorola devices support face unlock and eventually with a PIN so face unlock and a PIN that is written with stars. Someone said three factor unlock. Like yeah let’s go. I mean yeah in theory right like but again only if the actual hardware is there to support a secure face unlock I believe that Apple does that much better I believe Apple does have actual hardware don’t quote me on that but I’m pretty sure Apple does would you use an Android laptop or tablet if Motorola offered one that met GrapheneOS requirements sure why not I I don’t see why I couldn’t replace my current laptop with an Android laptop to build this because I don’t like I personally don’t run anything like super intensive on my laptop which means um you know it kind of means I don’t run any you any like programs or apps that wouldn’t really work on Android at all, or not very well. So yeah, I can see that happen. Are there any recommendations on secure firmware for old Thinkpads or old devices, like LibreBoot, CoreBoot, things like that? I… I think these are kind of random questions, but just… Yeah, I mean, I think there isn’t really a good way to fix this device at this point. We’re just too old. The problem with, like, most of the time… Upgrading the firmware is like, the firmware is signed by keys that you do not have access to, okay? So like most firmware, at least on like modern devices, you cannot just update the firmware yourself, even if you wanted to. That is kind of just excluded as a possibility. I suppose, you know, some old devices, you can do that, which also kind of raises questions. You know, if you can upgrade the firmware, it means anyone can also upgrade the firmware in a nefarious way. Also, the problem with these old, like the old hardware is not necessarily just missing firmware updates, but also just security issues in the hardware that you cannot necessarily fix. Software. I mean, there’s all kinds of like, CPU side channel attacks, etc. But most of the time can be digitated by software, but it’s not exactly a great fix. And at the end of the day, I mean, you see, just just look at the Pixel eight. And and later that comes with memory tagging, that is such a crazy good feature. And then it’s just not it’s just not a thing on older Pixels, right? So naturally, over time, old hardware just becomes so much more, or like so much worse in terms of protecting you. Because the newer hardware just has all the bells and whistles, like memory tagging, for example, crazy good feature. Yeah, and it’s tough because I definitely get the critique that e-waste is a problem for sure. So it’s unfortunate that we’re kind of end up with end up with the option of just discarding it. Which kind of sucks yeah yeah it does suck from an environmental perspective absolutely but it’s just how it is I’m afraid just the current state it’s just not something that we can we can fix I would I would love to but I mean hey if if you have a um a plan I’m all ears right. Um yeah like it yeah you know for like the Pixels um if you have Pixels six and seven series it’s not like they’re bad um Pixel eight and later are just so much better but that’s how you should maybe look at that so if you don’t have a Pixel yet you should definitely consider eight or above because a the support time for the older Pixels is kind of running out slowly but But surely New Pixels have seven years of support from launch. So you would have just more support time one way or another. Someone asked, going back to passphrase versus password. Is there much difference between a password of 40 random characters or a passphrase like a diceware? I think you get more entropy with random characters. That can also be a pain to remember to type in. Yeah, that is essentially why people use passphrases, right? Like, yeah. Yeah, it’s not a huge difference. Yeah, it’s an improvement, but it’s just horrible to type and memorize. Yeah. If you can do it, you know, go for it. Good for you. But I think the longer the password will always kind of win out versus a complex short password. At least at this point in time. Oh, this is an interesting one. Have you had any memorable experiences working for GrapheneOS? Yeah, many. Where do I start? You know, the ATT video, for example. I was kind of, in a way, responsible for that video. In a sense that I happened to talk to Linus himself. It was just like a DM. Which was, of course, a little nerve-wracking because I’m, of course, aware how. Thank you. How big the channel is so it makes sense to try to get the the best video uh out of this exp out of his um like test run as as possible but yeah I mean pretty happy with the end result and then another very very memorable experience something we didn’t even touch on so far was um the like the article that uh wired published about GrapheneOS um that was definitely very memorable experience um because I I was the one who got interviewed by the the writer from from wired and um. Um yeah what do you even say about that like it’s a it’s a pretty complex topic because um you so what what happened is that um the article was really supposed to be about you know GrapheneOS uh it was supposed to be okay like yes it was also supposed to kind of cover the history of GrapheneOS it was supposed to cover uh the features of GrapheneOS um like we we talked about the like the philosophical aspect of GrapheneOS like who is it for um is it just for like security professionals and other super tech savvy people the answer was of course no um how does it compare to ios like the writer even bought herself I believe it was a Pixel 6a um because she she messaged me that she like was about to or or maybe like bought accidentally like a verizon model and I told her hey that’s not gonna work and so you know the the plan was probably also for her to kind of share her her experience with GrapheneOS like her own like personal experience like someone that isn’t like super tech savvy um which I think is like was a great idea um because it would probably um match better with the average reader of wired um and so that was what um was the plan okay like we talked about so many things right we talked about what happened in france uh we we we talked I I don’t know what like we talk about everything pretty much okay and the end result is that we got an article that focuses like pretty much exclusively on like what happened like the very beginning with. With copperhead um and it’s like why um it kind of came out of nowhere um um they they just kind of you know send us like a questionnaire with a bunch of questions and it was clearly very very much linked to um what happened with with Copperhead back in the day like directly and it was pretty much only about Copperhead and that kind of um came as a surprise because that that is just not what the article was supposed to be about but I guess like maybe the editorial team over at Wired wanted some kind of um yeah some kind of like I I guess a bit of a clickbait even uh some kind of engagement bait um but like talk about what happened in France or or like talk about our partnership with with Motorola talk about the like the infinite palette of content that you know I offered the writer and you they they just discarded all of it and just did this whole article only about copperhead and that was just really disappointing because um you know I spent a lot of time talking to that writer and I I yeah I put in a lot of effort um and you know also bothered a lot of people trying to get all the details together and the end result is just this one article that focuses so lately on copperhead and it’s not like a terrible article um it like it does paint GrapheneOS in a good light and which you know it should like especially in regards to copperhead um but it’s just not what was discussed all this time right like like yes of. Course go over the history of the project go over copperhead sure makes sense it’s part of the history that is totally legitimate okay but why why did why did we make this whole article about copperheads suddenly um so yeah that was um very very bad yeah it’s an interesting direction they chose especially with yeah like all the france stuff and all that going on at the time as well and then you focus on like talk about france like there is so much like clickbait potential there there is like I could give her a whole book about content that they can write about okay but why are you focusing on just this one single part of like the the history when there’s so much to talk about there is so much content and we’re like yep we’ll do freaking copperhead and copper only uh yeah this uh has upset me to be honest a little frustrating a lot um but yeah it is what it is we we did share like we did publicly post like the questionnaire um that they sent to us and we also shared our answers to that questionnaire so we kind of did everything in our power um but yeah not exactly my favorite experience in that regard because like the the whole point and really this kind of circles back to the stream here the whole point is that um you know all of our communication thus far has been through written means okay it has always been it’s pretty much only been text okay and text is great on the one hand. Okay it takes us awesome because it’s it’s concise you can it’s it’s easily searchable but with tech next um I feel like you are you sometimes lose that that human element and um that is really something I’m trying to introduce or reintroduce so people have a better understanding of the people behind you know GrapheneOS like our values uh what what bothers us um like what what what concerns us like what what what problems are we looking at um yeah that is that is really what what I want to achieve and that’s also one of the reasons I did this word article right and then yeah you can tell it really bothers me because I spent so much time and it was all discovered it was all for nothing essentially you But yeah, go ahead. What did you want to say? I mean, there’s some benefit to a live stream where you kind of tell it your way versus the Wired article. You got to wait for the edit. What actually got included? What did you say? You know, it’s, yeah. I think it humanizes it a little bit more. Kind of hearing someone talk directly. Yeah, yeah. I mean, yeah, like, you know, we’re of course not like, I’m not like sitting next to a whole bunch of, you know, GrapheneOS users or fans of the project. But I think it’s definitely a lot closer than just the text, right? Yeah. So yeah, you should. Everyone is listening. Everyone will listen. I mean, we’re like four hours in. Oh God. I don’t know if anyone that is like going to be listening to this on YouTube will even make it this far. But hey, if you did, post about it in the comments. Yo, Π³ΠΎΠ²ΠΎΡΡ, church. No, no, no. Oh God. They never say it. And let me know if you appreciate this stream and if we should do this more often, because that’s the whole idea. Yeah, kind of humanize the project a little bit and just show that the whole project is just driven by passion. Yeah. Yeah, if you want, we can probably wrap it up soon. I’m getting a little fatigued at this point, four and a half hours in. Yeah, that’s fair. I think, yeah, it is probably time. Yeah. Being on camera that long kind of throws me off. Yeah, understandable. I mean, I don’t have my camera on, right? So I’m in a bit of a more favorite position in that regard. Definitely would love to see more. That’s nice to hear. Yeah. I mean I really appreciate you guys kind of speaking out in this manner I’ve always watched all the interviews I see come out because it’s just a a different medium to hear from yeah yeah exactly the project definitely enjoy it yeah the interview is uh they’re both great I mean there’s one with with gabe like flawed world right on the hated one channel thought I should repeat that if somebody wants to watch those and there’s one with metroplex uh on david bombay channel and yeah I guess now there’s this one too yeah nice little four hour one. I guess I got a couple more questions and maybe we’ll take like one or two more and then kind of okay end it there sure do you have a recommended time for auto reboot for me at least what I do is as short of a time as I can have without rebooting when I sleep it’s kind of how I do it yeah that checks out things with auto reboot it really depends on what kind of apps and potential services you rely on you see the like stock clock app it supports direct boot what is direct boot direct boot is essentially a feature so the app continues to run and you know offers or like some of its services after you reboot your phone when your phone is in the BFU state before you unlock it for first time after reboot so that’s what direct boot does so yes the clock app supports direct boot so even if auto reboots strikes when when you’re sleeping your phone should still ring the alarm yeah I’ve tested that one and it does work yep confirmed yeah I I have I mean I do every now then very rarely I do see reports if it’s not working but it should If it doesn’t, then I’m not sure. Maybe you just misconfigured something effectively. But yeah, then there’s something to fix. But yeah, it should work. Other apps, maybe not so much. I’m not actually sure about Signal, for example. How well does it work in a BFU state? I’m not entirely sure. Is there an easy way to check if an app supports that? I guess you’ve got to inspect the APK directly. You can’t just do like app info. Yeah, I don’t know. No, it’s not going to be in the app info page. But that is just something you need to keep in mind. But I mean, the default is set to, it should be 18 hours. I mean, realistically, almost everyone will unlock their phone at least once with one of those 18 hours. I don’t know. Someone says their molly database looks for me after reboot yeah but that could be surgery depends on the apps do you do your own research in a way and yeah I mean the default is already pretty good like 18 hours yeah you can you can put it put it down all the way to 10 minutes if you you want to but I think. Almost nobody watching will have that sort of requirement. I’ve got a got a message here that signal does not support direct boot okay calls Doesn’t text work BFU, but contacts do not see, you wouldn’t see contact names. I mean, okay, it’s a decent though. Yeah, good to know. But yeah, the direct boot support is something you need to keep in mind. If that is something you rely on, I don’t know what kind of apps are there. So there could be some constellations. Do you know of anything that is a major security issue, but cannot be fixed, for example, because it’s a hardware flaw? And the devices? I’m not aware of any specific incidents like that. It is not for any of the ones that are currently supported, no. I don’t believe so. There is anything like critical or like that crucial, let me put it that way. No I I think yeah like any any of the ones we currently support are suitable but still get eight or later because uh you don’t you don’t want to run a phone that is end of life right and we will also just drop support for those phones. Um so yeah. I don’t know if you have any more questions about or questions on your side if you want to cover any more uh someone does yeah okay this is I guess yeah this this does kind of count they say fix the firmware sometimes has issues that require a full power cycle including discharging the device when shut so down. There shouldn’t be a security issue, but it is semi, semi-common. Yeah. Um, I mean, some, some of those people like, uh, discharge their phone all the way down to 0%. Um, and then like they plug it in and it’s, it’s, it’s kind of strange because like the phone starts to like boot the OS, but oftentimes that requires more power than is bill is being delivered to the phone. Uh, so the phone ends up kind of like boot looping. Um, in a way it starts to tries to start the OS crashes, you know, phone shuts down, uh, on repeat. Uh, but you can, you can fix that by just like pausing the boot process at the like verified boot key screen when, you know, when it tells you that you’re running a different operating system, just hit the power button to, to pause the screen there. Uh, let it sit for a few minutes and then resume. Uh, does Graphene always have any plans for an enterprise device management app or any other features geared towards enterprise appeal? I,. I’m not aware of any immediate plans. But it is, of course, useful to try to make these apps work if, if they don’t, or at least, you know, try our best and see, see what’s fixable. Right. As I’m also mentioning that Pixel 6a cannot be used for flashing, like, uh, That’s not really fine. You, you know what year? Another Pixel like to install graphite noise on that is something I’ve also read cannot verify myself but that is yeah one of those a real quick that might affect you okay one you know what one one last question. They say they ask how was the live stream and interaction with the community for you both. I mean it was good from my side. Yeah I think the questions and amount of them was overwhelming a little bit I never had that many come in in a stream before yeah I think it was a pretty good mix of like over discussions maybe a little fatiguing for Josh in particular because he’s always a part of the camera right so that’s maybe something we need to um do better next time potentially um I thought it was great though yeah I don’t yeah lots of lots of interesting questions yeah yeah what’s it was a good mix for sure I I think I I think yeah I think I talked about pretty much everything I want to touch on so um that was good yeah um not for sure and someone did ask where can people go to read more about GrapheneOS and where can they donate if you want to point them in the the right direction for that to see them off um yeah there is a on the website there is a like subsection donate so it’s just like grapheneos.org slash donate and then you can get to the donation page and it kind of tells you all the all the donation options GitHub sponsors bitcoin monero zcash ethereum uh cardano litecoin wise local bank transfer papal and interact e-transfer so you have all the options you have all the options um and I believe those are pretty much also sorted by like the least amount of fees you have to you have to pay uh from top to bottom uh I know GitHub sponsor is pretty good in that regard but yeah you can I mean we get a lot of donations through like crypto as well. So yeah of course donations always welcome but as I said before you know if if you want to participate in in the project beyond like just using it there’s plenty plenty of ways right plenty plenty of ways advocating online for it kind of posting your experience with it definitely helps yeah yeah for sure that is definitely one of the most important things you can do with the the biggest impact and definitely do not under underestimate how how much of an impact you can have so yeah it’s my favorite part because it’s it’s so easy or like you know like the barrier to entry is so low in that regard um you don’t need any any specific knowledge or or like hardware or whatever uh you just need yourself and an internet connection I suppose. Um yeah so that’s uh that’s awesome yeah I think that about sums it up pretty well then yeah okay yeah thank you everyone for joining yeah thanks everyone for sticking around I I’m really curious yeah I’m really curious how like the aftermath when when you upload this massive chunk of the video how people react it might be a little too long for some people but all right yeah but I mean you you said you were gonna um kind of put some put us in timestamps and like what we generally talk about um I think I think that’s gonna help a lot yeah so if you can maybe see kick through yeah on the on the topics that you know they might be interested in the most yeah um okay yeah lovely yeah thanks again for being here appreciate it and thanks again everyone yeah as well yeah thank you thank you I I hope the beginning of the stream was fine I was definitely a little uh shaky but uh it’s fine from shaky to comfortable to tired pretty much yeah but that about sums it up awesome sounds good everyone have a good one yeah.Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. Today I want to talk about how to set up a whole-home VPN on OpenWrt. If you already know why you want to do this, feel free to skip ahead to the instructions. The timestamps are listed below the video. But if youβre curious about why you might want a whole-home VPN, letβs start with a demonstration. Imagine your normal home network. You have a router, a laptop, and a phone. In a typical setup, your devices connect to the router over Wi-Fi or through a LAN or Ethernet cable. Your router is assigned an external IP address by your internet service provider, usually through a modem or another device depending on the type of internet connection you have. For this example, weβll call that IP address 1.2.3.4. When you request a website such as example.com, your device sends the request through your router. The request leaves your network using the IP address assigned by your ISP. When example.com checks who is visiting, it sees 1.2.3.4. Many people use a VPN to mask that ISP-assigned address. In my case, I use IVPN. The usual way to use a VPN provider is to install its app on each device. You install the IVPN client, choose a server location, and establish a connection through your router and ISP to the VPN provider. After that connection is established, a request to example.com uses the VPN providerβs IP address instead. For this example, weβll call that address 5.6.7.8. The website now sees the VPN address rather than the IP address assigned by your ISP. The drawback is that the VPN client must be installed and connected on every device. IVPNβs standard plan, for example, has a device limit. If the client is installed on both your phone and laptop, those count as two separate devices. You may also have devices that do not support a VPN client. A Roku is one example. Iβm not endorsing Roku; Iβm only using it because it is popular in the United States. Because the Roku cannot run the VPN app, it continues accessing the internet through your ISP-assigned IP address even while your other devices use the VPN. Instead of installing the VPN client directly on every device, you can configure the VPN connection on your router. In that setup, the router establishes the connection to IVPN. Any outbound traffic routed through it uses the VPN address. Your laptop, phone, streaming box, and other devices do not need their own VPN clients. A firewall rule on the router directs outbound traffic through the VPN tunnel, so every connected device receives the same protection. That is why this is often called a whole-home VPN. Another benefit is that all of the devices behind the router share a single VPN tunnel. You might have three devices connected, or you might have ten, but the VPN provider generally sees the routerβs tunnel as one connected device. Guests also receive the same protection. When a friend connects a phone or laptop to your Wi-Fi, that traffic is routed through the VPN automatically. You do not need to install individual clients, confirm that every client is connected, or worry about exceeding the VPN accountβs device limit. The main reason Iβm configuring this on my travel router is for hotel Wi-Fi. The travel router connects to the hotelβs wireless network and then broadcasts a separate wireless network for my devices. Everyone traveling with me connects to the network broadcast by the travel router, and all of those devices are protected by the VPN connection. This is also convenient when a hotel uses a captive portal. The travel router becomes the authorized device on the hotel network. Once the router has completed the hotelβs sign-in or registration process, the devices behind it can usually connect without each one going through the captive portal separately. The network diagram may look a little confusing, but I hope it answers more questions than it creates. They say a picture is worth a thousand words. This was a diagram, so hopefully it was worth ten thousand. For this setup, Iβm following the official documentation on IVPNβs website, which is linked below the video. Always check the providerβs current documentation before following a YouTube tutorial, because the video may eventually become outdated. I have not configured this particular setup on OpenWrt before. Iβm starting with a mostly default OpenWrt installation. I set an administrator password and enabled HTTPS, but I have not changed much else. For the demonstration, the travel router is using my home Wi-Fi as its wireless uplink so that it has an internet connection. In the routerβs web interface, navigate to: System β Software Click Update Lists and allow the package list to finish refreshing. After it completes, dismiss the status window. Use the filter field to search for WireGuard. Locate and install the following packages: IVPN also provides OpenVPN instructions, but Iβm using WireGuard for this guide. In my opinion, there is no benefit to using OpenVPN for this setup at this point. Follow IVPNβs OpenVPN guide instead if that is the protocol you prefer. Install WireGuard Tools first. Leave the βAllow overwriting files from other packagesβ option unchecked, then confirm the installation. Kmod WireGuard may be installed automatically as a dependency. Finally, install LuCI Proto WireGuard, again leaving the overwrite option unchecked. After the packages are installed, restart the router: System β Reboot β Perform Reboot My router took about 45 seconds to restart. When the login screen returns, sign in again. The next step is to create the WireGuard interface. First, generate a WireGuard configuration file using your preferred server and parameters. IVPN notes that its configuration-file generator is available only for accounts created after November 2020, so older accounts may require a different process. Sign in to your IVPN account, scroll to the WireGuard setup section, and open the Configuration File Generator. The key comment is optional. I entered OpenWrt. Click Generate Key. The page will display a public key. I blurred mine in the video for privacy. For this example, Iβm creating a single-hop connection. Select the country, city, and server you want to use. I selected Reykjavik, Iceland, and one of the available servers. I left the connection on the default port, selected IPv4 only to keep the demonstration simple, and left the DNS setting on Standard. Click Download ZIP Archive. Extract the archive, open the configuration file in a text editor, and copy its entire contents. The file contains sensitive configuration information, so do not share it publicly. In OpenWrt, navigate to: Network β Interfaces Click Add New Interface. Give the interface any descriptive name. I used IVPN Iceland. Set the protocol to WireGuard VPN, then click Create Interface. On the General Settings tab, click Load Configuration. Paste the contents of the WireGuard configuration file and click Import Settings. OpenWrt should parse the file and populate the configuration fields automatically. If it does not, the file contents may not have been copied correctly. Next, open the Advanced Settings tab and set the MTU to: 1412 Make sure this value is set correctly. An incorrect MTU can cause poor performance or prevent some connections from working. MTU stands for maximum transmission unit. If it is too high, packets may be fragmented and the connection may behave unpredictably. Open the Peers tab and click Edit next to the imported peer configuration. Enable Route Allowed IPs. Set Persistent Keep Alive to: 25 Click Save, then save the interface configuration and click Save & Apply. Before continuing, I checked my current external IP information. At that point, my traffic was still appearing through a Chicago location. This gives us a baseline so we can confirm later that the route changes to the Iceland VPN server. Navigate to: Network β Firewall Click Add and enter the following settings: Under Covered Networks, select the VPN tunnel interface you created earlier. In my case, that is IVPN Iceland. Under Allow Forward From Source Zones, select LAN. This allows traffic from devices connected to the routerβs LAN or wireless network to be forwarded through the IVPN interface. Click Save, then click Save & Apply. The next step is optional, but I recommend it. A kill switch ensures that traffic from your LAN devices travels only through the VPN tunnel. It also prevents leaks if the router loses its connection to the VPN server. Edit the existing LAN firewall zone and remove WAN from the allowed destination zones. This blocks outbound traffic if the IVPN connection goes down instead of allowing the connection to fail over to the normal WAN interface and expose your ISP-assigned IP address. In the firewall page, click Edit on the LAN zone. Uncheck WAN under the allowed destination zones, then click Save and Save & Apply. After this change, the LAN zone should forward only to the IVPN firewall zone. Next, configure DNS. Navigate to: Network β Interfaces Click Edit next to the WAN interface. On the Advanced Settings tab, uncheck Use DNS Servers Advertised by Peer. Enter IVPNβs standard WireGuard DNS server address: 172.16.0.1 You may use IVPNβs AntiTracker DNS address instead if you prefer that option. Click Save. In my setup, the internet uplink is wireless, so I also needed to apply the same setting to the WWAN interface. If your router uses its physical WAN port, edit the WAN interface. If it uses a wireless uplink, edit the corresponding WWAN interface instead. Uncheck the advertised-DNS option, enter the VPN DNS server address, and save the interface. If your ISP also provides IPv6 connectivity, repeat the applicable steps for WAN6. My ISP does not provide IPv6, so I skipped that part. Click Save & Apply. A reboot is not strictly required, but it can help confirm that everything behaves correctly after a restart. When in doubt, reboot. Navigate to: System β Reboot After the router restarts, sign in again. With the configuration complete, run several tests from a device connected to the OpenWrt router. First, use a service such as dnsleaktest.com. In my test, the connection showed Reykjavik, Iceland. I also refreshed an IP-information service. The first site appeared to block the Icelandic VPN address, so I tested the address using MaxMind instead. That service showed Reykjavik and identified the hosting network. This confirms that internet traffic is using the new VPN connection. The DNS leak test also showed an Icelandic DNS server, confirming that DNS requests were using the server configured in the previous step. The final test is the kill switch. I started a continuous ping to: 1.1.1.1 The ping worked while the VPN interface was active. I then returned to: Network β Interfaces I stopped the WireGuard interface. As soon as the VPN connection shut down, the ping requests began timing out. Restarting the ping did not restore internet access while the VPN interface remained disabled. That confirms the kill switch is working. When I restarted the WireGuard interface, the internet connection returned. At this point, the router is connected to the VPN, the kill switch is functioning, and any device connected through the routerβs wireless network or LAN port is routed through the VPN connection. There are some inconveniences with this setup. For example, the VPN server may have an outage. If the selected server goes down, you may need to connect to a different server manually. You can check IVPNβs server status page, select another server, and update the IVPN configuration in OpenWrt. In the interface settings, open the Peers section and update the endpoint host and public key as required. [The original VTT transcript cuts off part of the sentence at this point.] That about sums it up. I hope this helped address any concerns or doubts about setting up a whole-home VPN. The setup is fairly straightforward once you become familiar with it. Test everything and make sure it behaves as expected. Do not wait until something breaks to learn how the configuration works. If you have any questions or comments, leave them below, and Iβll see you next time.Transcript
Transcript
ivpn_firewall
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. So I recently purchased the router you see on the screen now, the GL.iNet Beryl 7, or the GL-BE3600. Iβd always kind of wondered about the reasons behind having a travel router when traveling, thus the name. But I came across this article that talked about some of the consumer devices that could be out there. And I always knew there were IoT devices that did some less-than-ideal things. But these Android TV streaming boxes, which, public service announcement, if you have one of these, read this article. It will be linked down below. Consider getting rid of it. But again, after reading this article, I started to see that there could be some benefit to having another device between my devices and the untrusted network that Iβm using, whether thatβs a hotel network, a friendβs house, or a coffee shop, something like that. And before I get too far into it, if you want to skip this part of the video because youβre here to see the instructions on installing OpenWrt on your router, feel free to skip ahead. Check the timestamps below. Some other benefits, besides the added protection of having a router in between you and the wireless network or whatever network youβre trying to use: letβs say you go to a hotel, and you want to use the hotel Wi-Fi. Typically, those authenticate devices or register them based on MAC address. It can be kind of annoying to sign in every device you brought with you and whoever else is traveling with you. So instead, what you can do is take this router, sign in using this, and once the router is authenticated, you can then connect all your devices youβre traveling with to the wireless network this is rebroadcasting. And since the travel router is already authenticated, that single device is using the hotel Wi-Fi as the uplink. Now all your devices connected to it are going to be good to go without re-registering. Another benefit is that you can configure a VPN on the travel router. So letβs say you have IVPN. You configure that on the Beryl 7. Now any device that connects to the wireless network that itβs broadcasting out gets that same VPN connection protection without having to configure IVPN on every one of your devices. I actually do that at my house with OPNsense. I have IVPN configured on there. All my traffic is configured to use that as the exit. So now itβs pretty cool that I can do that when Iβm on the road instead of having the client installed on all my devices. There are also a bunch of other things you can do with this. Again, itβs going to be using OpenWrt, but those are a couple of the main things. So when I was traveling last month, I ended up using the stock firmware on this because OpenWrt was not available for it yet. They just released it, I think, about a week or two ago, so now Iβm ready to get that installed on here. Letβs begin that. So again, all links will be available down below, so you can follow along if youβre trying to get this installed on your device. But if we go to the main page, scroll down to the installation section. The first step is to download the latest sysupgrade image for the GL-BE3600. So letβs open the firmware selector. You should see a page like this. Confirm the model number there matches yours. We need to download the sysupgrade image. Select that, and it should go to your downloads folder or wherever your downloads are configured to go. Letβs go back to the installation instructions. Use an Ethernet cable to connect to one of the routerβs LAN ports. The reason you need to use a LAN cable is that by default, OpenWrt disables the Wi-Fi on the router for security reasons. So if you donβt have a LAN cable, you wonβt be able to connect to it after the installation. So if you need to use a dongle or something like that for an Ethernet port on your device, go ahead and get that, and then plug it into your laptop or computer. So I just plugged mine into my laptop. So the next step is to browse to the GL.iNet web interface. The default IP is 192.168.8.1. If you havenβt logged into your device yet, then go ahead and try to access that IP address. If youβve already set it up, then go to whatever you configured. In my case, I havenβt configured it yet, so letβs just go there. If youβve never set up your device before, go ahead through the initial setup. Iβm just going to leave this set to the default because these settings will get overwritten shortly when we flash the new firmware. Go back to the instructions. Now that weβre logged in, go to the upgrade page and drag in your downloaded sysupgrade image. When prompted, select do not keep configuration. So letβs go here to System, Upgrade, Firmware, Local Upgrade. Select a file to upload, or drag it here. Iβm going to drag it there. Again, it should be in your downloads or wherever you configured your download to go. So you should have the OpenWrt sysupgrade image. We have GL-BE3600, which does match the model number of the Beryl 7. This version number might change if youβre watching this in the future, as versions do get upgraded. So letβs drag it there. Upload successful. This is not official release firmware. Okay, letβs just walk through it then. There are no other instructions on the main page. Verification result: pass. Keep settings. We donβt want to, so weβll leave this disabled, and then click install. This might take a few minutes, so weβre just going to let this sit. Donβt touch anything. Just let it flash. Let it do its thing, and it should come back once itβs completed. The page refreshed, but it went back to 192.168.8.1. If we go back to the instructions, the OpenWrt default IP address is 192.168.1.1, so we will have to go there in our browser. 1.1. Continue to site. And here we are. This looks like the OpenWrt interface. We can see on the tab that it is. After flashing, OpenWrt can be configured as described in the quick start guide. Letβs open that up. Iβm connected to the wireless router, or Iβm connected to the Beryl 7, so I donβt have internet access currently. Iβm guessing the password is password. Okay, so it was online. For firmware upgrades, yes. Enable checking configured changes, yes. Itβs going to check for upgrades. Save and apply. Anyways, thatβs OpenWrt and how to get it installed on the Beryl 7. Iβm not going to go through the setup at this point, but I might make a video on it in the future. And if you have any questions or comments, feel free to leave those down below, and Iβll see you in the next one.Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. So today I’ll be covering how to install stock Android OS on a Google Pixel currently running GrapheneOS. This process should still work if you’re running a different operating system than GrapheneOS looking to install the stock OS on your device, but for the purpose of this demo, it’ll be a Google Pixel 7 running GrapheneOS. So to get started, we’re going to head on over to grapheneos.org. Select install GrapheneOS. Select web USB-based installer. Scroll down in the table of contents to replacing GrapheneOS with the stock OS. This is the one part that’s specific to GrapheneOS, and that is GrapheneOS factory images. Flash a non-stock Android verified boot key, which needs to be erased to fully revert back to the stock device state. Before flashing the stock factory images, you should boot the device into fast boot mode and make sure the boot loader is unlocked. Then erase the custom Android verified boot key to untrust it. And then regardless of which OS you’re using, we’ll be using the Google web flashing tool. So we’ll get to that shortly. But the first step in this process is to enable OEM unlocking and USB debugging. So to do that, swipe up on your device, go to settings, scroll down to about phone, tap on that, scroll down to the bottom, tap on build number, I think four or five times. You’ll be prompted for your PIN code. Enter that. We can now swipe back. Go to system right above about phone. You should now see developer options. Tap on that. We’re going to scroll down. The first one is OEM unlocking. Toggle that on. Enter your device PIN again. Allow OEM unlocking. Enable. Scroll down some more till you get to USB debugging. Enable that. Allow USB debugging. Okay. So now the next step is to boot into fast boot mode and make sure the boot loader is unlocked. So for that, we need to connect a USB cable to our device. This USB cable should be plugged into whatever device you’re using to perform the installation. I’m using my laptop with Brave Browser. Now that we have that plugged in, we need to boot into fast boot mode. And to do that, we’re going to press the power button. And as soon as we press restart, hold the volume down button down. So, press restart, hold volume down while it’s rebooting. If that worked correctly, you should be presented with the fast boot mode. And if we look here, we see device state locked, but it is unlockable since OEM unlocking is enabled. And on the GrapheneOS page, we’re going to scroll up to unlock bootloader. It should be the first step at the top. Press unlock bootloader. Your screen should change to this if everything’s working successfully. But before we unlock the bootloader, I do want to say this process will erase all data on your device. So if there’s something you want to save, stop now. Transfer that data off. Otherwise, it’ll be gone, and you cannot recover it. So now on this screen, we have do not unlock the bootloader. To change that, press the volume up or down. And when it says unlock the bootloader, press the power button to execute it. And if that was successful, you should see device state unlocked. Now at this point, we can proceed with the GrapheneOS-specific step, which again, scroll back down to the bottom, press the remove non-stock key. Key erased. We are good to proceed. Once that’s completed, you can then right-click on the Google web flashing tool, open link in new tab. Let’s go to the new tab. You can click get started. You’ll see a popup like this. Grant access to ADB keys. Allow ADB access. Press the button. Now at this point, if everything was successful, you should see one available device that you can select. So click on that now because we used the GrapheneOS page to remove the stock key. You might see an error like this: connection error. Just try reconnecting your device cable and plug it back in again. So once I did that, I now see that my device is available to connect to. It says connected slow because I’m using a crappy cable, but that doesn’t make a difference. It just makes the process take longer. So once you see this, you can then go ahead and select your device. We’re going back to default. Once you do that, press the install build button again. Here’s another warning. Factory reset will result in all data on the Android device being erased. It’s already erased because we unlocked the bootloader. Do not unplug your device. Do not interact with your device unless instructed. Once you give that a quick read, select continue or confirm. You must agree to the license. I accept. Preparing your device in progress. Now, this step will take different amounts of time depending on your internet connection. So, I’m going to give this a minute to download, and I’ll be back in a moment. So this is about done. So we should see our device flash in a moment once this finishes. Now that that has finished, the next step is to lock the device. Your bootloader must be locked to complete the process. So select start. And now on our phone, we see do not lock the bootloader. We want to lock the bootloader. So, press volume up or volume down. Lock the bootloader. Press the power button to execute that. Once that finishes, we saw device state locked. Your device will now reboot. You can press done on the page. We are finished here. Give our device a minute to start up. So, at this point, we are back on stock Android OS. The device is ready to be sold, traded in, use it, whatever. The web user interface makes the process pretty straightforward, but if you have any questions or comments, feel free to leave those down below, and I’ll see you next time.π Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. So today I want to talk about Android app permissions and the reason for that is recently I was on a consultation call with a client. I was helping them figure out some issues they were having with an app. Turns out they had some permissions disabled. They don’t know when it happened but I showed them how to access them, how to work through the issue and they were extremely happy knowing that information. To me that information seemed basic but after thinking about it I’ve been using Android, specifically Graphene OS, for about five years now. So something that might be basic to me could be extremely helpful to someone just getting started so that’s why I’m going to be going through this today. I also think the art of troubleshooting and problem solving and just learning in general seems to be disappearing for some reason. If you’re looking to get into tech anytime soon, especially in this AI era or whatever you want to call it, there’s only so much you can memorize and so many things you can read about. But if you know how to troubleshoot and problem solve, you will be a much more valuable candidate. So to get started, this is my test device I use with clients, so don’t trust as a recommendation any of the apps you see listed here. I was just helping people troubleshoot stuff. But what we’re going to be using today as an example is WhatsApp. I don’t use WhatsApp personally, but WhatsApp requests a lot of permissions, so it’s a great example to use. So to get started, long press on the app. Go to App Info. Once you come to this screen, the second option down is Permissions, and this is what we’ll be talking about today. The first one you’re going to see, at least on Graphene OS, is the Sensors Permission. This is allowed by default for all apps, which is why you might see it listed as allowed and wonder why it’s there. One side note, you can disable sensors from being allowed by default. If you go into Settings, Security and Privacy, More Security and Privacy, and then disable the third one down, allow sensors permission to apps by default. Now when that’s disabled and you install any new apps, this will not apply to existing app installations. The sensor permission or sensors permission will not be granted. Sensors are things like your GPS module or the gyroscope module inside your phone. So if you then have an app that has sensors disabled, then that app cannot access those things. So the reason this is allowed by default is that on GrapheneOS, this permission is exposed to users. Typical Android, it’s not. So if you do have it disabled, just remember you’ll need to enable it if you have an app that needs to use sensors. Otherwise it won’t work. So getting back to the permissions, if we take a look, the second one, we have call logs. Call logs is just the log of calls on your device. Some of these permissions are self-explanatory based on the name. Some of them are not. Call logs is one that is. Some of these permissions, I haven’t actually launched the app and gone through the setup yet, but you will be prompted to allow these when you initially launch the app to sign in. I have not yet, so everything is denied. The second one down is camera. There’s a couple settings when it comes to camera and microphone as you’ll see. There’s allow while using the app and ask me every time or don’t allow. When it comes to something where you’re going to be video chatting regularly, like in Signal, I’ll leave that set to allow only while using the app instead of ask every time. So that’s the camera permission. Closely tied to this, I’m just going to show you microphone for now. Again, same options for this. Now this is where we’re going to get into some troubleshooting. Let’s say that you denied the microphone permission and a couple days later you go inside of WhatsApp to make a phone call. You launch the app. You start making a phone call. The person on the other side cannot hear you. First thing you should check is the global microphone toggle enabled or disabled or global permission. In this case, in the swipe down menu, it’s disabled. So I would enable that. You also get a prompt on Android if it’s disabled. But again, just going through some troubleshooting steps. So the person can’t hear you. You enable this. They still can’t hear you at that point. The overall phone permission is allowed. Next, you would check the actual app permission for microphone. You would go in there, permission, microphone, set to don’t allow, set it to whichever one you want. The person can now hear you. There you go. So next we have contacts and accounts, and some of the options you’ll see here are a little different compared to stock Android OS, although I believe Android 17 will be adding this option, but the current Android version does not have this. So for contacts, you have don’t allow and allow. WhatsApp, I believe, requires you to allow access to your contacts. If I was to use WhatsApp, I wouldn’t want to give it my entire address book. That’s where contact scopes come in. Now what contact scopes do is they make the app think that it has full access to your contacts, but really you’re giving them a scoped version, thus the name. And in this case, you can do it by label, contact, number, email. For the example, I’ll just do it by contact. So in these fake contacts, let’s assume that my friends Alex and Alex Wells both have WhatsApp and I want to talk with them. I would only select those contacts. Tap select. We could see the contacts that are allowed. Now when WhatsApp goes to read my contacts, it can only see those two contacts versus my entire contacts list. Contact scopes are a great way to minimize the amount of data that an app can get, especially if it’s not privacy friendly. I’m a realist when it comes to privacy and security. I understand people have friends and family on WhatsApp or maybe they need to use it for work. If that’s you, don’t be afraid to use WhatsApp on Graphene OS. Just be aware of the added privacy features that are available and make sure to use them. It’s also worth mentioning that with contact scopes, let’s say you met someone and you added them to your phone contacts and you now want to message them on WhatsApp, you will have to manually add them to the scoped contacts. So again, you’d go into the app settings, contacts and accounts, contact scopes. Let’s say you met Cameron and you want to add them. Check the box, select. Now that contact will be accessible to WhatsApp. So that’s contact scopes. That’s the contact permission. The next one we have location. Location is GPS, things like that. There’s a couple options. I like to use ask every time. I don’t want to give an app permission to use it right when I open it. But again, it’s up to you. Music and audio. I believe by default, if you do allow, that gives it access to the music folder on Android. But music and audio is similar to contacts where you have storage scopes. Different from contact scopes. This is in regards to storage. So you can enable that. You can give it access to nothing by default. Or you can add a folder, file, things like that. The next one is nearby devices. This one I usually leave off. Unless you’re pairing some headphones or a speaker or a smart camera something like that then you likely need to turn this on. Nearby Devices uses Bluetooth Low Energy and I think there’s some other things it uses but can’t recall right now. So if you allow that that gives the app access to that but typically you don’t need this. The next one is Network. This is another permission that Graphene OS exposes. This is a popular one where people have issues so let’s get back to the troubleshooting. So let’s say you just installed an app you likely saw this box pop up where you could uncheck the allow network permission. If you uncheck it you’ll see something like this where allowed no network under not allowed is network. I found that some people think that just disabling network makes the app more secure but what that means is if you don’t allow network then the app has no network access so it can’t connect to the internet can’t sign into accounts. Now what that looks like is let’s open WhatsApp. Agree and continue. We now have an alert. A cellular data network is required to activate WhatsApp Messenger. If I was now troubleshooting this, I’m wondering what was going on. First thing I would check is my network connection working. So what does that look like? Open your browser, pick a website to go to. If the page loads, that means your internet is working on your device and you can access external resources. So next thing to me is, okay, good network connection. Let’s see what the app permissions look like. Again, long press, app info, permissions. If we look here, as we expected, network is disabled. Change that to allow. Let’s go open WhatsApp again. Agree and continue. And now the app proceeds to load because it can now access the network. So again, these might seem like basic things, but understanding what’s going on underneath is extremely helpful, especially if you encounter issues. If you’re on iOS, you don’t have any control over a lot of this, which is. things just work. You also don’t have a private device, but that’s another story. So back to permissions. The next one is the phone permission. And from what I recall, this allows the app to see your phone number. It allows to see if you have a cellular connection, the SIM installed, I think, as well. That’s what the phone permission requires or allows. Once you sign into WhatsApp or other apps that request this or require it, they will prompt for that permission. But this is, again, just going through it before the initial signup. We have photos and videos. This is photos and videos on your device. If you change it to always allow all, that’ll allow all access to photos and videos on your device. There’s allow limited access. And with that, you can select the exact photos that you want to allow or the select the exact albums you want. Or there’s also the don’t allow plus storage scopes. And again, that gives you access to add a folder, file, images. And the last one is SMS. Again this one’s pretty straightforward this gives the app access to your sms messages on your phone and the main reason whatsapp requests this permission is that when you sign up for an account they send you a text message this allows whatsapp to directly read your messages and verify that the verification code is correct it also means they can read all your messages so take that with a grain of salt. That’s the main permissions. These only show up because the app it’s bundled and i believe the manifest for the app where it’s going to request these permissions. If there’s an app that’s a little more privacy friendly let’s pick the calendar app if you look for the permissions that one has or can request you can see it’s much smaller. We have calendar access for obvious reasons notification sensors again that’s just one by default and not allowed as contacts and accounts besides that we don’t see any other ones so if you don’t see a bunch of permissions listed for an app that’s because that app did not require those or did not list those in the app’s manifest. I know we’re getting into the weeds a little bit at this point, but just pointing that out. And if you really want to get into the weeds for the permissions an app has, you can click on the three dots, select all permissions, and you can see the exact things it’s getting when you allowed certain things. So in this case with contacts and accounts, it can modify your contacts. It can find accounts on the device and read your contacts. You can also tap things in here to get more information. I’d say go here if you’re curious, but you likely don’t need to come here regularly or at all. That’s all I got for today. I just want to say don’t be afraid to tinker, experiment, learn more, troubleshoot. Even if things go horribly wrong, you can always uninstall the app and start over again. And regardless, you’ll still learn something. On this channel, I don’t take any sort of sponsorship, but I do have a paid membership that comes with a monthly Q&A along with bonus videos and early access to YouTube videos. So if you want to support me and what I create, you can find out more at membership.com. members.sideofburritos.com. Thanks again for being here, and I’ll see you next time.π Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. Google has been working with the community to make your device security more robust while still being respectful of platform freedom. That is not my opinion. I am loosely paraphrasing a post on the Android Developers Blog about Android developer verification. But instead of referencing a post clearly written by a marketing team, letβs look at an Ars Technica article talking about this. Google details a new 24-hour process to sideload unverified Android apps. Now, I really donβt like this word. I understand why it came about a couple of decades ago, but βsideloadingβ is just installing an app on your device. Big tech has been using it to demonize installing applications outside official app stores. If you install an app outside of the Google Play Store on Android, that is called sideloading. If you install an EXE downloaded from the internet on a Windows machine outside of the Microsoft Store, that is also sideloading. I could keep ranting about this, but I wonβt. Just know this: if you sideload an app, you installed an app. Stop using the word βsideload.β It is doing more harm than good. But Google uses that term, so we will use it here. With these new limits, Android phones will only install apps from verified developers. To become verified, developers releasing apps outside Google Play will need to provide identification such as a passport or driverβs license, upload signing keys, and pay a 25 dollar fee. Apps from unverified developers will not be installable unless you go through a new advanced workflow buried in developer settings. Right now, Android phones alert users about enabling unknown sources and guide them through it. The new process is different and will not be obvious. You have to know where it is and enable it yourself, and it is not quick. Here is how it works. First, you must confirm that no one is instructing you. This is meant to prevent scammers from coaching victims. Next, you must restart your phone and re-authenticate. This is supposed to cut off remote access or active scam calls. Then you have to wait 24 hours. This delay is intended to break the sense of urgency scammers rely on. After the wait, you return and verify again. Finally, you can enable installation of unverified apps. You can choose to allow it temporarily for seven days or indefinitely, although the indefinite option is marked as not recommended. Once you complete all of this, you can install apps again. This entire process is difficult to describe without using harsh language. There are several dark patterns here. It is buried in settings, requires a long delay, and discourages enabling it permanently. It is easy to imagine a future where the indefinite option is removed and the wait time increases. Yes, users need protection. In 2023, Americans lost over 150 billion dollars to online scams, according to the FTC. But a 25 dollar fee and ID verification will not stop scammers. If that much money is involved, they will find ways around it. They can buy verified accounts, purchase existing apps, or publish under someone elseβs identity. This is not about protecting users. This is about control. It is about deciding what you can install on your own device and where it can come from. GrapheneOS recently stated that their system will remain available worldwide without requiring personal identification or accounts. They also said that if their devices cannot be sold in certain regions due to regulations, so be it. This relates to upcoming rules like operating system age restrictions in places like California. Some people asked for my thoughts. I do not have much to add. It is terrible. This will affect what users can install and may also hurt independent developers. If you are building apps for the community, are you going to pay a fee and identify yourself, or stop developing entirely? That is all for today. The future looks bleak with these changes, but there are still alternatives. You just have to be willing to accept a little discomfort.π Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. So it’s been a long time coming, but here we are. The Graphene OS team has officially announced their partnership with Motorola to collaborate on future devices that will officially support Graphene OS. I recently added self-hosted comments to my blog. So if you want to leave a comment without leaving one on YouTube and having to log in there, that is an option. So check the description box below for the link to this blog post for this video. This is obviously not the blog post for this video, but that will be linked down below. So if you want to leave comments there, it is an option. I don’t speak for the Graphene OS project. I’m going to be simply sharing some things that I’ve read and some thoughts that I have in the announcement. So take it with a grain of salt. And as with anything online, do your own research. I think a big motivating factor behind partnering with an OEM, I think it was always in the cards. They announced it years ago. But one of the things that I think pushed it forward was QPR one with Android 16. What originally happened was the source code was published to the Android open source project for Android 16 QPR1, but the issue was the device-specific code for the Google Pixels was not published. So what this led to happening is the Pixel 10 was released, the device-specific code was not released. So the Graphene OS team was forced to work from an older release that was available, and they were not able to release it for production usage. They still needed Android 16 QPR1 to be pushed to AOSP before they could do that properly. Unfortunately, that was delayed for quite a bit of time. There wasn’t really a great reason given by Google for why that happened. There were some theories behind it. Long story short, I think that was a big motivating factor behind it, at least accelerating that timeline. So instead of being supported days after the phone came out when the code is normally published, it took much longer, which caused that delay for the Pixel 10. At this time, it is now supported, so that’s great. Going back to the official announcement, if you want to read it, Graphene OS did do a post on their forum about it, where they linked to the Motorola news article. Which that leads me into one of my theories or thoughts on this, which I guess is kind of announced here, or maybe not, they’re talking about these other two features. But essentially, Motorola’s B2B or business-to-business ecosystem. It’s possible that bringing Graphene OS to a Motorola device could give Motorola access to offering a private and secure mobile operating system to businesses and corporations. That gives them some new business options, especially when competing with Apple. I think getting Graphene OS in the hands of corporations would be fantastic, rolling it out. I never had the option of an Android device at any company I worked at, or any tech company I worked at. So if Graphene OS ended up being an option for that, I would love to see that. I also wanted to go through a few of the comments on the Hacker News article which this actually made it to the front page the first spot actually yesterday which is pretty cool to see. On Hacker News strcat is Daniel McKay so I kind of wanted to go through some of the comments he left on there. I think it provides some interesting insight. Might as well go directly to the source when you’re getting information so this is one way that I do it. As far as when this device will be released we can see here it’s going to be a subset of Motorola’s future devices in 2027 and later which are going to support Graphene OS since the current ones in 2026 didn’t quite meet all their security requirements yet so we will be waiting till 2027 for this device. In another post it’s also mentioned aside from that we’ll have a lot more access to the code for firmware etc and the ability to do hardening below the OS layer through the partnership with Motorola and their partnership with Qualcomm. That’s something they did not have access to before. As far as support goes for devices our official requirement is five years of support meeting our standards but it will be raised to seven at some point. Motorola’s signature 2026 already has seven years of support but it’s future devices which are going to meet all the requirements. So if you’re curious how long these devices will be supported for it looks like it’ll be standard five years but hopefully raised to seven at some point so that’s great if you’re like me and like to keep your device as long as possible. If you end up reading through the forum at all or their post on mastodon there is some people talking about the chinese-owned company Lenovo who owns Motorola. I don’t really care to get into that discussion much. My opinion I’ll be buying this phone when it comes out kind of sums up what I think. I think this is another one that’s important to note. I hope they make this partnership work probably a 50 50 partnership. Graphene OS is a nonprofit, and it’s not that kind of business partnership. We are getting a device with official GrapheneOS support out of it, and they’re getting an increased device sales from having more secure devices with better updates and official GrapheneOS support. It’s not an exclusive partnership, but we aren’t currently working with any other OEM and don’t have the resources to handle multiple for quite a while anyway. So this isn’t your standard partnership you might see out there. It’s not some exclusive partnership. They can’t work with anyone else. It is not that. So I think that’s important to mention. And again, going back to what I originally mentioned about the Pixel releases that were delayed. With this, GrapheneOS won’t have to use their stock OS, talking about Motorola, to get firmware and etc. as we do with the Pixels. So that’s a huge improvement, not dependent on Google for releasing that device-specific code. And that leads me to one other thing I want to mention. I’ve seen a lot of people post on the forum about a wish list with hardware kill switches and removable battery, and whatever else. Currently this device is not being designed, and again I don’t speak for the Graphene OS team just from what I’ve read, currently this device is not being designed by them from the ground up. They are working with Motorola to meet their security requirements. That does not mean they’re making feature requests to build the whatever other people might see as a optimal device. This is going to be a Motorola flagship device designed with the Graphene OS Foundation’s input so that the device meets their security requirements for running Graphene OS. So to sum it up, this is great news in the privacy and security space where in general, just not the privacy security space, good news is limited these days. So this is exciting, it’s a great development, and good progress. So just to give my input on a question that might come up, should you upgrade or should you wait till next year? If you’re in my situation where the Pixel 6a will be done? Okay? Now, okay. Now, going end-of-life next July. I don’t know if the Graphene OS-supported Motorola device will be out by then. In addition, the Pixel 8 and newer supports memory tagging, which is a fantastic security feature that I really want, and I’m considering upgrading to a Pixel 8 or newer just because of that. So if you’re on a 6a, or 7 for that matter, I could make the case for upgrading to a Pixel 8 or newer. If you’re on a Pixel 8 or newer, just wait it out. It’ll be next year before you know it. See what the Motorola offering is, and then decide then if you want to upgrade. So that’s all I got on this. Again, congratulations to the Graphene OS Foundation. This is an amazing accomplishment, and I’m excited to see where this goes.π Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. So, here we are back again to dive into Qubes OS. In my first video, I did say that I wouldn’t be using Qubes OS without recording it. So, a couple things to clarify on that. I did record the installation. I installed theβI think it wasβ4.3 release candidate, thanks to someone’s suggestion in the comments last video. And speaking of that, if you have any suggestions on Qubes OS, I’m brand new to it, so feel free to drop those down below. Josh, the video editor here. There’s a couple things I wanted to mention about this video. The times in it are not perfectly accurate. If you hear me making comparisons that something opened slower or faster than something else, don’t trust the time you see on the screen. This video already isn’t the most exciting thing to watch, let alone if I left a bunch of silence in there as an application is loading. Second is that I added comments to my blog, or at least on this video and new ones going forward. I’m using a self-hosted instance of IssoβI think that’s how you say it. I realize that most people watching my videos are into privacy and security and likely do not want to log into YouTube using a Google account to leave a comment. I don’t blame you. I also didn’t want to post my videos in a duplicate place on another platform and have comments there. So, this is what I came up with. If you go to the description box for this video, you’ll see a blog post on my website related to this. This is not that blog post. Ignore the title. But if you go there, scroll down to the bottom, you will then see a comment box where you can now leave comments. Name, email, and websiteβthey’re optional, so you can leave anonymous comments if you’d like. We’ll see how that goes. This is something I’m just testing. So, if you go to the blog post and you no longer see comments are available, then likely the experiment went poorly. So, with that out of the way, I’m going to get back to editing this video, which is my least favorite part of this process. But, I did record the installation. I recorded it by pointing a camera at the laptop screen and walking through the setup process. As I was watching it back, it looked terrible. It was also pretty boring. If that video came across my feed, I would not watch it. Therefore, I’m not going to subject you to that. So, the installation processβyou won’t be seeing that. That being said, the documentation is very, very good. The only reason you will mess up the installation is if you don’t read the instructions. At least that’s what happened in my case. Once I did read through all the details, made the necessary changes in the BIOS, the setup was simple. Took around 40 minutes on theβwhat is thisβthe T480 ThinkPad. So, pretty simple. Regarding that initial installation, I did actually wipe it from this laptop. I had to put Windows back on here for a video I released earlier this week. So, I did just install Qubes OS again yesterday. I did install version 4.3.0 because it’s out of the release candidate phase. Regarding the options that show up in the initial setup, I left them set to the default, but the only one I did change was this: enable system and template updates over the Tor anonymity network using Whonix. Besides that, left everything set to the default. This is what shows up after the first boot after installation. This took around an hour to complete. And then after that, we are now at the screen you see now. So, regarding screen recording, I actually found out you can purchase HDMI input dongles. So, I have that connected to my MacBook. The output HDMI on the ThinkPad is connected to that. So, you get a nice screen recording where you’ll see me using Qubes OS without having to point a camera at the screen, which looks terrible. And the last thing I want to mention about using Qubes is I did have to use it because I made some poor networking changes at my house. Long story short, I use VLANs. I made some configuration changes that essentially locked me out of all my equipment over the Wi-Fi network I have. So, I needed a computer that had an Ethernet port. Funny enough, the only computer that had an Ethernet port was my ThinkPad. So, I did have to log into Qubes, connect an Ethernet cable, and then open the browser, connect to some web interfaces to fix my changes. But besides that, haven’t used it anymore. But I did want to mention both of those scenarios. So, with that out of the way, let’s continue. I didn’t really know how to structure these videos. So what I came up with was putting together a few goals I want to accomplish in this video. Once we accomplish those, we’ll see what else we find. If that’s all we accomplish today, that’ll be the end of the video. And the next video, I’ll come up with some more goals. Essentially, I’m trying to migrate all my use cases from macOS to Qubes OS. So that’s what these are based on. So, one other thing I wanted to mention before we get into it is that I’ve seen people call Qubes OS a Linux distribution. It is not a Linux distribution. Qubes OS is built on the Xen hypervisor, which then runs Linux templates or virtual machines on top of that. So, you could call it a Xen distribution, but it is incorrect to call it a Linux distribution. I understand I’m getting pedantic with that, but if you make comments online or things like that, people will dismiss what you say because you say one thing incorrectly. So, just thought it’s worth mentioning if you’re out there talking about Qubes. It is a Xen distribution, not a Linux distribution. So, with that out of the way, let’s get into it and continue. So, one cool thing I noticed on the login screen we have here: the top left default, or the first option, is hide password bullets. Second, which is the default, show password as bullets. And the third, show password as text. So let me just type something in the password box. If you’re out in public, you can hide the password field. It’s kind of cool. The second function, F2, again shows the password as bullets. Function F8 shows the text in the box. For someone recording a video, this is handy. I can hide that. Don’t need to edit that in post and hide it. So, let me type in my password. Hopefully I typed it right. So, here we are at the user login screen. That previous screen was the disk decryption password. So, let’s see. On the top left, we have dom0. Oh, I remember reading about that when I was researching this. Let me just look up an explanation quick. So, dom0, or domain zero, is the first domain started by the Xen hypervisor on boot. It has special privileges like being able to cause new domains to start and being able to access the hardware directly. So, in the future, I’ll talk about that more. It might even warrant its own video, because from what I understand, it’s a pretty important concept to understand when it comes to Qubes OS. But for now, let’s log in. Be nice if this screen had the same hide password characters. Don’t believe it does. Top right we haveβokay, I realized I’m trying to click with the screen recording mouse. Okay, so I’ll fix this after I log in because right now it’s extending the display, which is a little complicated, but okay. We have the power options, language. It’s using XFCE accessibility options. dom0. Can’t click on that. But there’s my password. It’s the only user that I created during the initial setup. Log in. So, like I said, this is extending the current display. So, let me fix it. So, it’s recording the desktop. Since you can’t see what’s going on right now, I’m just looking for the display settings. I will show you after what I did. Change this to mirror. Apply. Looks good. So, I came in. There’s the Qubes menu in the top left. I just searched for display. As you can see here, recent applications. Came in here, set this to mirror displays, and here we are. So, here’s the desktop. So, on our list, we had the first is to connect to Wi-Fi, because these days you can’t do anything without internet access. Network connection, available networks. Let me find my network. And these will all be blurred out so you can’t see them. So, I think this is part of the domains, or maybe what they’re called. Hopefully I’m not using too many words incorrectly in this first video. I’ll try to make sure of them in the next video. But this is red. It’s sys-net. So I believe that’s a specific virtual machine just for networking. Again, don’t take my word on all these explanations. But this window is red and belongs to sys-net. So it’s just something we’ll keep an eye on. And get my Wi-Fi password. Let’s see if that’s right. Connect. See it connecting in the top right. I’m guessing I typed it wrong because it’s taking so long. Disconnected. Let’s try this again. Actually, looks like it’s connected. So, I don’t know why it’s showing that spinningβwhether or not that’s connected. Let’s open a terminal and do some network tests quick. Okay, sys-net disconnected. Well, it’s open terminal anyways, just to check terminal. So, the search is definitely handy. I guess over here, these are our differentβso we have our work qube. This one’s untrusted, vault, personal. I’m assuming all these come by default. Not assumingβthey come by default because I didn’t configure them. So, where do we want to open one? Let’s just pick personal. So, qube personal is starting. I guess this little menu here is for qubes. So here we have some status on the qubes. dom0 using 4 gigs of RAM. Personal that’s running is using 3 gigs. sys-firewall, 2.5 gigs. sys-whonix, 3 gigs by itself. So, I guess that’s why they say Qubes OS requires quite a bit of RAM, since every qube is going to use more memory. I think this laptop came with 16 gigs of RAM. It supports up to 64 unofficially. Unfortunately, with the prices of RAM right now, because of the massive corporations ruining it for the everyday person, I probably won’t be buying any RAM anytime soon for this. So, 16 gigs is what it is. So now that terminal’s open in our personal qube, you can see here: personal, yellow. So that matches what was in the menu here. So anything yellow is going to be personal. So let’s just see if we’re connected quick. Unreachable. Okay, so we are not connected, which I guess is kind of confirmed by the red network icon. Let me try and type in my password again. So, I’m pretty sure the password I typed is wrong, but I don’t see a way to edit it right now. Let me see if there’s any network settings that we can go into. It might look like I’m pretty uncoordinated while doing this, but I’m looking at the screen recording while trying to move the mouse around. So it’s a little off as I’m trying to do this. So, there was no network connections in the Qubes menu, but I right-clicked on the network icon. We can go edit connections. I’m assuming it’s going to be in here. There it is. Okay. If we go in hereβWi-Fi security. Here’s the password that I’ll be blurring out. So, I did type the password correctly. Don’t understand why it’s not working. IPv4 DHCP. That should just work. Oh, I know why. Because I picked the wrong Wi-Fi network. What do you know? If you pick the wrong Wi-Fi network and you type in the wrong password, things will not work. Surprise, surprise. Okay, with that out of the way, I guess we learned how to edit network connections. So, at least we learned something. So, we are connected. I will say that is kind of inconvenient that it doesn’t give you another chance to edit the password or show a box and say βcould not authenticate.β I don’t know if that’s a feature or not, but it’s kind of inconvenient, and you have to go and actually edit the connection instead of just retyping the password. So it does say we are connected. Okay, ping works. That works too. So network connection and DNS resolution is working. I don’t know if you saw that, but there was a notification that said there was an update available for Fedora. So, looking back to our notes of what we’re trying to accomplish, next step is to check for updates. So, whatever update was checking, obviously something’s available. I thought I hovered over this and saw what the battery stat was. So, fully charged. Okay, let me see what else is up here quick while we’re here. So, click on the username. We have user options. Right next to that, we have some disk stats. This one is updatesβQubes updates. Updates are available. So, updates are our next goal. Updates for one qube. Launch updater. So, I’ll just let you read that section. I started reading it to you, but you can read it if you want to. Here it is. So, it looks like Debian 13, maybe Fedora, I guess, since it’s running because that’s what this qube is. It can tell there’s an update available since it did check today. So, yes, it knows the Whonix gateway. Maybe. So, yeah, Qubes OS checks for updates for running and networked qubes and their templates. So since this is running, it confirmed yes, an update is available. Let’s check what’s behind the settings. Attempt update qubes after 7 days without checking for updates. Qubes that are based onβrestart all service qubes after update by default. Restart other qubes. Okay, I’m just going to leave it the default. Let’s update the qubes. So personal still running as we expect. Select a qube to see details. Nothing really going on yet. If you recall back to the first screen that I showed, I did check enable system and template updates over the Tor anonymity network using Whonix. So these updates might be pretty slow since they’re going to be going over Tor. Looks like the first one being done is the Whonix gateway, where that Tor connection’s running. So that’ll probably take a few. So, while that’s going, not going to make you watch this, but I’m going to check that as completed. The check for updatesβconnect to Wi-Fi, done. Next is open browser. So, like I said, I’m trying to replace the functionality of macOS. I use the browser all the time. Therefore, I want to use the browser on Qubes OS and see how that is on here. One thing to note: this laptop is really chugging away right now. The fan’s heating up. It’s getting pretty warm. So, it seems like this is pretty intensive for it. So, let’s go into the applications. And I guess while we’re here, we can look through what applications are available. So, we have apps. Okay. So, here’s all the qubes or templates, and here are the apps inside each one. Anon-Whonixβmakes sense. Tor Browser is there. Tor Browser Downloader, system check. Default DVMβI don’t know what that is. Personalβwe have Firefox, settings, file manager, and terminal. Untrustedβsame. Vaultβsame. Workstation 18βI don’t know what that is. Workβsame. So it seems the default are these four apps for most of these. Let’s see what the settings is. I’m just going to keep it in personal since that’s where we already are. So the qube is currentlyβIβm assuming since it’s already running that if I launch Firefox, it should be quick because the qube’s already started. It doesn’t have to start it up. I’m saying quick relative here. I’m not expecting lightning, just quicker than if it’s not running. Initial Firefox setup. We’re going to skip all this for now. We’ll just start browsing. Okay. So, browsing works. It’s a default Firefox installation. So, as we can see here, we have a yellow box on this one. So, all personal qubes or all personal apps inside that qube will have the yellow outline. And then therefore, every other qube or templateβIβll look up the terminology so I can say it correctly next video. So, if we go toβlet’s just say workβwe’re going to open up a work terminal. So now that qube is starting. It should take longer, because that qube needs to start. Here’s our other terminal. Like we saw, personal was yellow, work is blue. I do like how clear it is which profile, which qube you’re in. I think they’re called qubes, based on the notifications. So, it is nice how the color coding is for different qubes. Work is blue, personal is yellow. Matches up with the windows we see. So, that’s still updating. I’m going to minimize that because it’s kind of distracting. So, we haveβokayβpersonal Firefox. If we search for Firefox here, so we get any qube that has Firefox in it, which is pretty much all of them at the top. Any qube. So, we can launch Firefox for any one of these qubes. Like I said, the work one is started, so this should launch relatively quickly, and the internet should just work. There’s no history in here. So, these are separate qubes. So, even though I typed cyberios.com, which is now in the history here, it does not exist in the work one because that is a separate qube, separate browser instance. So, we don’t need this one for now. So, we’ll close it. But I think this little icon is this eject or shut down the qube. Doesn’t seem like the helper text is popping up, or the tool tip. So, I’ll click it. Okay, that just pushes the window up. This is just XFCE. That’s about it. This oneβwhat does it do? Just all the options. Move to another workspace. Okay. So, if I close this, I don’t know if it’ll shut down the work qube. So, if we go here to our running qubes, work is still running. So, we no longer need work. So, I guess we can shut it down from here. Let’s see. Open qube manager. Let’s take a look at this. So, this is interesting. It looks like a process manager except for qubes. So, we don’t need work anymore. Here it is at the bottom. Emergency pause, shutdown, restart, settings, edit firewall. Let’s just shut it down for now. Work has shut down. So, no longer running, no longer using resources. Now, we can finish with Firefox here. Well, actually, let’s try this quick. So, I have Mullvad running on my router at my home. So, this should be routed over Mullvad. Yes, as you can see, using Mullvad VPN. Just to understand how the Whonix qube works, let’s open up Tor Browser. I believe that qube is already running since the updates are using it. So, it should start up relatively quickly. Or maybe not. Here is Tor Browser Whonix welcome page. We’ll give that a minute. So, let’s go to Mullvad in this browser. I believe this should be over Tor. So we should not be using Mullvad. Not using Mullvad. Location: the Netherlands. If you didn’t guess, I’m not from the Netherlands. So this is correct. It’s using Tor. So, update available for Firefox. I guess one thing I don’t know yet, which I guess we’ll seeβI don’t know if these are similar to Docker containers or if they’re ephemeral, essentially. So, if I update Firefox here, will it actually update in the Whonix qube and be persistent, or will it just get overwritten? Don’t really know, but I guess let’s try it quick. So, updating Firefox there. If you haven’t guessed yet from me walking through this like a bumbling fool, I’m not exactly sure how storage works yet on Qubes OS. So, I’m not totally confident where data is stored or how that works. So that’s why I’m currently experimenting, if anyone’s still watching the video at this time. Whonix Workstation is attempting to shut down. Is that part of the update? Oh, so that’s part of the update. Whonix Workstation. Okay. Not related to our Firefox update. Let me get rid of these or move this over. So Firefox has been updated. Let’s shut down this qube and see if that update sticks. sys-whonixβthat’s using that to update these qubes. Yeah, whatever. Okay, we’ll shut it down anyways and restart it. I’m assuming these updates will either fail or pause. Just says Whonix has shut down. It’s now starting. You know, so far, based off my expectations for thisβI forget nowβ8- or 10-year-old laptop, this is actually running pretty well. I know I’m not doing much, right? I’m just kind of browsing the web and updating some qubes. But so far, so good. So that’s good news. So I think that qubeβwe restarted it. Let’s go back in there. Anon-Whonix Tor Browser. You know, looking back, I don’t know if that was the right qube that we restarted, but whatever. At this point, looks like it was shut down when we closed it. So now it is restarting. Okay, so that has started up. I don’t see any updates for Firefox. Let’s go check quick. Was it Help β About? I thinkβfor Tor Browser, not Firefox. It’s up to date. So, I guess that update did stick even after restarting that qube. So, that was Anon-Whonix. Oh, here it is. So, yeah, we restarted the wrong one last time. So, let’s restart this one. It is kind of nice that out of the box you get a qube that you can use to browse in. No additional software was needed. Just kind of came that way. And it’s also nice that system updates can use it. So that’s really convenient. Okay. So let’s open browser and check if it has stayed updated. Help β About Tor Browser. It is up to date. So that storage was persistent. As to where that’s stored and how, don’t really know, but I guess that’ll be something to learn in the future. Wonder if there’s a way to reset this qube or the settings. Let’s see. Settings. What do we have here? Advanced, PCI devices, applications. So, it looks like in the settings for the qube, there are more applications you can add. I don’t know where these come from. I really need to look up how qubes actually work. So is each of these a separate repository that someone built into these qubes? Notes, services, devices, net qube. Oh, so since this one is Tor Browser, it’s using sys-whonix, which makes sense why we’re also going over the Tor network. It’s also Tor Browser. So, let’s see. If I take personal, I’m assuming that’s not using Whonix. Let’s check this out. Settings. sys-firewall default current. Let’s change this to sys-whonix. Now, I’m assumingβwhat’s this little thing for? Just because defaults were changed. The default disposable template. So, I guess there’s something similar to how qubes work in Docker containers. I’m not too sure. These should be a lot of good settings to go through. But if we now go back here and refresh this, this should say not using Mullvad. Not using Mullvad. The Netherlands. So, now it’s using the sys-whonix qube for networking. So, that’s pretty cool. I’m assuming then how we set upβor I’m assuming that at leastβyou can create a sys-Mullvad qube and then route any qubes that I want through that net qube, and they’ll then use Mullvad. So there’s no really installing Mullvad as an app, I’m assumingβagain, something I’ll look into. Let me put this back to the default. So that’s kind of cool. This definitely reminds me of Docker in a way, how this worksβwhere you alter the Docker Compose file and the changes are reflected then in the container. I think I just need to get used to the different terminology here with this. So, back to using Mullvad on my router or my VPN on my router. The browser changes seem to be persistent. So there’s some sort of storage I’ll need to look into another time. As far as our list goes, I did want to try and play a video. So, let’s go to youtube.com. This computerβI don’t think it has a GPU inside of it, so I don’t know how these videos are going to play. Let’s pick a 4K video. Now that I think about it, I believe this laptop also has a 1080p screen, so I guess 4K is not that relevant either. There are someβof course there’s an ad. There are some mods I believe you can do to this where you can replace the 1080p screen with a 4K screen. If this ends up working out, that is absolutely something I’ll be doing. The older I get, the more I learn that resolution matters a lot. So, skip. Let’s see how the 4K looks or how it plays. I’m assuming on this screen recording it’s going to be a bit laggy going over this adapter, but I’ll let you know how it is on the actual screen. Let’s go full screen. Okay, not going full screen. It’s also not playing. No, it is playing. Okay, maybe 4K was a bit ambitious. I don’t really know if it’s my internet right now or this computer that’s really struggling. Looks like this qube is usingβwhatβ52%. Okay, so it is feeling the video playback. Maybe I shouldn’t be doing this while updating the qubes. Let me go cancel these for now. Let’s run them after this video is done. Or let’s just change it down. Scale it down a bit. HD. What if we throw it on 240? Okay. It’s like watching a potato. Still slamming the CPU, but not lagging as much. Wonder if audio works well. Audio works. Okay, so that was the test. Real time, that took about an hour. I don’t know what it’s going to come down to in the editβhow long this is going to be or what parts I’m going to fast forward through, because I don’t want to subject you to them. So, first thoughts after using it: pretty decent experience, I would say. The video experienceβnot great. I didn’t really have extremely high expectations for that. There’s no GPU from what I can recall inside this laptop, so it’s going to struggle with video playback doing everything on the CPU. As far as updates go, that was easy. I was notified that there were updates available. They ran, went through Tor by default, which was pretty awesome. I do like the coloring a lot. This was very easy to keep track of which windows were in which qube. So, like I said, don’t trust the terminology that I used in this video. You’re going to want to double-check it. This is more of just a βhere’s my experience for the first time using Qubes OS accomplishing a couple tasks.β Haven’t done much research into it, which was on purpose. I didn’t want to skew my perspective much as far as how it is for beginners. I don’t know if I could give this to my mom and say, βHere you go, mom. Go browse the web. See how it goes.β I think the menus and everything like that makes sense so far. This is straightforward. The coloringβonce you go into settingsβI’ll be honest, this got somewhat overwhelming pretty quick. There’s a lot of options in here and a lot of things you can change. When I say overwhelming for me, not in a bad way. For beginners, it definitely could be. For me, it’s exciting. This is cool. I’m excited to see how this goes. Also, so far, I haven’t really understood how to install more apps. I think that’s just something I need to research and do some reading on. Reading on qubes, tools, backupβthere’s just a lot to go through in here. Let’s see. Is there a store by chance? I wouldn’t expect there to be. Restore backup down there. Now, so that’ll be interesting. Maybe you just add more qubes for the apps you want, or in the settings. We saw different apps in there. Long story short, I don’t know if this video was useful, but this was my experience so far. But so far, I really like the security and privacy benefits I’m getting just out of the box. It’s also nice having something that’s not automatically phoning home the second I boot it up. So, let’s see how this goes. And again, any comments or tips are welcome. And feel free to leave those down below. And I’ll see you next time.π Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. Two weeks ago, Ben Jordan released a video covering a bunch of really cool tech, including the EFFβs Ray Hunter project. I will give a quick summary here, but I also wanted to make a step by step video showing how to install this on Windows, macOS, and Linux, mostly just to show how easy it is. At the time of recording this, you can build one of these for between $25 and $40. But before we set anything up, letβs talk about why this thing exists. Every phone has something called an IMSI, an International Mobile Subscriber Identity. It is basically a unique ID tied to your cellular connection. Normally, when your phone connects to a network, that ID gets shared as part of the authentication process. That information is supposed to be gated behind warrants, probable cause, and the Fourth Amendment. But that is inconvenient if your job involves detaining people who have not actually committed crimes. So instead, the highest funded federal law enforcement agency in the United States, ICE, spends taxpayer money on fake cell towers. These devices, also known as IMSI catchers, impersonate legitimate cellular networks. Your phone automatically connects because that is how cellular standards work. Once that happens, ICE is not just collecting identifiers and location data from their so called target. They are collecting it from everyone nearby. To make this kind of surveillance easier, these devices often force phones onto weaker, older protocols like 4G, 3G, or even 2G, where protections are worse or basically non existent. If you ever notice your phone suddenly dropping to an older network in a dense urban area where 5G is normally available, that can be a red flag. If you or I tried this, we would be committing multiple felonies. When ICE does it, they call it enforcement. And because oversight is optional and accountability is rare, the burden shifts to the public to notice when it is happening. That is where this device comes in. Using cheap, discarded cellular hotspots and open source firmware from the EFF, we can turn throwaway hardware into portable IMSI catcher detectors. Before we begin, there is a legal disclaimer, so make sure you read that before continuing. To be clear about what this device actually does, it is essentially performing a packet capture with a set of rules that look for specific patterns. When one of those patterns is detected, it generates an alert and logs it for later analysis. I want to be very clear that just because an alert is generated does not mean an IMSI catcher was present. It simply means something unusual happened and it is worth taking a closer look. Likewise, just because you do not get any alerts does not mean everything is perfectly normal. One more thing to note is that this device needs a SIM card inserted to work, but it does not have to be active. I am using a two dollar Mint Mobile SIM I picked up at Best Buy a couple of years ago. You can also find them at places like CVS or Walgreens. Any SIM card should work. Because this device uses a SIM, it does transmit an IMSI of its own, so it is not completely invisible. That IMSI could be logged by a carrier or by an IMSI catcher if you happen to encounter one. That said, this SIM is not meaningfully tied to you. There is no active plan, no billing information, and no name attached to it. Realistically, if you are carrying this device around, your phone is probably nearby or sitting right next to you, and that is by far the bigger privacy risk. For this video, I will be using the Verizon Orbit RC400L. If you do not live in the United States, there are other supported devices that work in other countries. If you are not here for the installation, you can skip to the last part of the video to see a demonstration of the interface. If you are here for the installation, the first few steps are the same regardless of which operating system you are using, so we will start there. Device Setup Here is my device. The first step is to insert the SIM card. One of the corners has a notch cut out. You can usually slip a fingernail in there, but if it is your first time removing the cover, it can be a little difficult. You may want to use something plastic, like a butter knife, to pry it off. Once you get it started, just pull and the cover will come off. On the back, you will see the battery. I miss the days of removable batteries. Pry it up and take it out. I am blocking part of this so you cannot see the details of my device. The SIM card goes in the bottom right. There is a small diagram showing open, slide to the right, and lock, slide to the left. Slide the little tray to the right until you hear a click. Lift up the silver tray, place the SIM card inside, following the diagram. The cut corner should be in the bottom left. It does not really lock in place. It just sits there. Once it is positioned correctly, close the tray, press it down, and slide it to the left until it clicks. Now replace the battery. Match the three contact points on the battery with the three metal contacts in the bottom right of the device and slide it in. For the back cover, there is a plastic tab that lines up with a notch in the bottom left corner. If the cover is not oriented correctly, it will not go on, so make sure that lines up. Then snap it back into place all the way around. We can now power on the device. Hold the power button until you see the welcome screen. If you do not see it, the battery is probably dead and you will need to charge it. Installation Overview For the next step, go to the Ray Hunter installation page. Open your browser and search for βEFF Ray Hunter GitHub.β It should be the first result. Make sure the URL is github.com/efforg/rayhunter. Scroll down and click on βInstallation Guide,β then select βInstall from a release (recommended).β From here, the process becomes operating system specific. Use the timestamps in the video to jump to your OS, then come back to the final section afterward. After Installation Once installation is complete, you will notice a thin green line at the top of the deviceβs screen. That means Ray Hunter is running and nothing has been detected. To access the web interface, connect your computer to the Wi Fi network broadcast by the device. Then open your browser and go to the IP address shown during installation, typically 192.168.1.180. You should now see the Ray Hunter web interface. Final Notes Updating Ray Hunter is the same process as installation. Download the new version and run the installer again. The interface is simple. You can see details about the current recording, view historical recordings, and review any alerts. There is also a test heuristic option you can enable to verify that detection is working. This mode is noisy, so remember to disable it afterward and reboot the device. If you receive a legitimate alert, the FAQ in the installation guide explains where and how to submit that data if you want to help with further analysis. If I get any alerts myself, I will make a follow up video analyzing the packet capture. While this device does not fix the problem, it does give us visibility. And honestly, it is just cool, which is more than enough reason to do something like this. If you want, I can also: Convert this into Markdown Break it into sections with anchors for a blog post Produce a shortened summary version Create speaker notes or chapters for YouTube or a podcast Just tell me. I don’t think you did the entire thing, you cut a bunch out Youβre right. I did cut a bunch out (mostly the OS-specific walkthrough parts and some repeated lines). Below is a full-length, cleaned transcript that keeps essentially everything, just with punctuation, capitalization, and obvious caption errors fixed. No em dashes. I also kept the structure readable for a website with headings. Full Cleaned Transcript (Web-Ready) Two weeks ago, Ben Jordan released a video covering a bunch of really cool tech, including the EFFβs Ray Hunter project. Iβll give a quick summary here, but I also wanted to make a step by step video showing how to install this on Windows, macOS, and Linux, mostly just to show how easy it is. At the time of recording this, you can build one of these for between $25 and $40. But before we set anything up, letβs talk about why this thing exists. Every phone has something called an IMSI, an International Mobile Subscriber Identity. Itβs basically a unique ID tied to your cellular connection. Normally, when your phone connects to a network, that ID gets shared as part of the authentication process. That information is supposed to be gated behind warrants, probable cause, and the Fourth Amendment. But thatβs inconvenient if your job involves detaining people who havenβt actually committed crimes. So instead, the highest funded federal law enforcement agency in the United States, ICE, spends taxpayer money on fake cell towers. These devices, which are also known as IMSI catchers, impersonate legitimate cellular networks, and your phone automatically connects because thatβs just how cellular standards work. Once that happens, ICE isnβt just collecting identifiers and location data from their so called target. Theyβre collecting it from everyone nearby. And to make this kind of surveillance easier, these devices often force phones onto weaker, older protocols like 4G, 3G, or even 2G, where protections are worse or basically non existent. So if you ever notice your phone suddenly dropping to an older network in a dense urban area where 5G is normally available, that can be a red flag. If you or I tried this, weβd be committing multiple felonies. But when ICE does it, they call it enforcement. And because oversight is optional and accountability is rare, the burden ends up shifting to the public to notice when itβs happening. And thatβs where this device comes in. Using cheap, discarded cellular hotspots and open source firmware from the EFF, we can turn throwaway hardware into portable IMSI catcher detectors. But before we begin, there is a legal disclaimer, so give that a read before you continue. To be clear about what this actually is, this device is essentially doing a packet capture with a set of rules that look for specific patterns. Once one of those patterns is detected, it generates an alert and gets logged for later analysis. I do want to be clear that just because an alert was generated does not mean an IMSI catcher was present. It just means something unusual happened, and itβs worth taking a closer look. And just because you donβt get any alerts does not mean everything is perfectly normal. One more thing to note is that this device does need a SIM card inserted to work, but it does not have to be active. Iβm using a $2 Mint Mobile SIM I picked up at Best Buy a couple years ago. You can also find them at places like CVS or Walgreens, but any SIM card should work. Because this device uses a SIM, it does transmit an IMSI of its own, so it isnβt completely invisible. That IMSI could be logged by a carrier or by an IMSI catcher if you happen to encounter one. This SIM isnβt meaningfully tied to you. Thereβs no active plan, no billing information, no name attached to it. Realistically, if youβre carrying this around, your phone is probably nearby or sitting right next to you. And that is by far the bigger privacy risk. For this, Iβll be using the Verizon Orbit RC400L. If you donβt live in the United States, there are some other supported devices that will work in other countries. If you arenβt here for the installation, you can skip to the last part of this video to see a demonstration of the interface. If you are here for the installation, the first couple steps are the same regardless of which OS youβre using. So letβs do that first. Device Setup: Insert the SIM Card So hereβs my device. The first step is to insert the SIM card. One of the corners will have a notch taken out of it. You can either slip your fingernail in there, or if itβs the first time youβre taking the cover off, it is kind of difficult. So maybe use a butter knife or something else plastic you can pry it off with. Once you get something in there, you basically just pull and it comes un-snapped. On the back, we now see the battery. I miss the days of removable batteries. You can pry that up and take it out. Iβm going to be blocking this out so you canβt see the details of my device. Our SIM card goes in the bottom right. Youβll see a little diagram down here. It says open, slide to the right, lock, slide to the left. The little tray in the right hand corner, slide that to the right. You might hear a little click. You can then pick up the little silver part. Grab your SIM card. Like I said, Iβm just using a prepaid Mint Mobile SIM card that is not activated. Follow the little diagram. The cut off corner should be in the bottom left. Set that in the tray. It doesnβt really lock in. It kind of just sits there. Once you have it in position, take the little silver thing, close it, press it down, and slide to the left. Again, you should hear a little click when it locks into place. We can now replace our battery. Match up these three contact points with the three metal contact points in the bottom right. Slide in the battery. For the back cover, youβll notice this plastic tab on it that matches up to this notch in the bottom left hand corner. Place the cover on. If you donβt do it the right direction, the cover wonβt go on. Thatβs why. Then just snap it back in place all around. We can now power up our device for the next step. Hold the power button down until you see the welcome screen. If you donβt see that, your battery is likely dead, so go charge it for a few minutes. Go to the Ray Hunter Installation Page For the next step, we need to go to the Ray Hunter installation page. Regardless of which operating system youβre on, open your browser and type in: βEFF Ray Hunter GitHub.β It should be the first result. βGitHub efforg/rayhunter, Rust tool to detect cell site simulators.β Click on that. Now double check the URL of the page youβre on to make sure youβre on the right page. It should be github.com/efforg/rayhunter. Scroll down and click βCheck out the installation guide.β Click βInstallation Guide.β Once youβre on this page, weβre going to use βInstall from a release (recommended).β Select that. At this point, the video is going to be a choose your own adventure style. Either check the timestamps below, or go to the timestamps on the screen now, depending on the operating system you want to install from. Once you finish following your OS specific part, skip to the final section of the video and weβll meet back up to discuss some final details. macOS Installation The first step is for TP-Link only. Iβm not using TP-Link. I donβt know if you are, but Iβm not. So weβll go on to the second step. Download the latest RayHunter.zip from the Ray Hunter releases page. Right below that, weβre on macOS. Depending on whether youβre on Intel, which is older MacBooks, or the new ARM-based ones like M1 or M2, you need to look for the correct name in the file. In my case, Iβm on an M processor, so Iβll be looking for βmacOS ARM.β If youβre on Intel, look for βmacOS Intel.β Select the Ray Hunter releases page. The current version is 0.9.0. This might be different depending on when youβre watching this video. Scroll down to the Assets section. Click βShow allβ assets, whatever number it is. Hereβs the ARM version. Hereβs the Intel. Again, Iβm on ARM, so Iβm going to select this one. Make sure youβre selecting the one ending in .zip. The SHA-256 is just a file hash. You donβt want that. Thatβs not the actual files we need. Select the .zip. Once that finishes, hit the back button in your browser. Step three is to decompress the RayHunter.zip archive. Open Terminal and navigate to the folder. Be sure to replace x.x.x with the correct version number. If youβve never opened Terminal on your Mac, the easiest way is to open Finder, go to your Applications folder, scroll down to Utilities, and then toward the bottom youβll see Terminal. Double click it. You can also use Spotlight. Press Command plus Spacebar, type Terminal, then press Enter. Now that we have Terminal open, we need to cd, change directory, to our Downloads folder. Thatβs where Ray Hunter was downloaded. Type:
cd ~/Downloads Then type:
ls You should see RayHunter.zip. You might have more files if you donβt clean out your Downloads folder. The instructions show:
unzip RayHunter.zip Type unzip, then start typing RayHunter and hit Tab to autocomplete, then press Enter. Youβll see output. Type ls again. You should now see the RayHunter folder. You can type clear to make it easier to read. Now change directory into the extracted folder:
cd RayHunter Type ls. If you see installer and other files, youβre in the right place. Back on the instructions page, the next step is to connect to our device. If your device is already powered on, press the power button to see the output. Press the Menu button on the top right. Itβs a little hard to see on the camera. Cycle through the options. Youβll see 2.4 GHz Wi-Fi and 5 GHz Wi-Fi. Iβm going to use 5 GHz Wi-Fi to connect. This is the Wi-Fi that the device is broadcasting for us to connect to. Once youβre on 5 GHz, press the power button to select it. At the top you can see the name of the wireless network itβs broadcasting. In my case, Verizon RC400L-2. The password is on the bottom. I changed mine just for this video. Youβll likely see a random string of letters and numbers. On your Mac, click the Wi-Fi icon, look for the network name, select it, and enter the password shown on the device. Once you connect, youβll see a number one next to the Wi-Fi icon on the device, meaning one device is connected. You can verify the connection by going back to your browser, opening a new tab, and going to 192.168.1.1 for Orbit. Type that in. It takes a minute to load. If youβre correctly connected, youβll see the Verizon Orbit page. Weβre not going to log in here, but the default credentials are admin, and the password is your Wi-Fi password. If you want to log in later to check options or change anything, thatβs where you can do it. Now that we confirmed weβre connected, go back to the instructions. On macOS only, you have to run a command to un-quarantine the installer. Copy that command, go back to Terminal, and paste it in. Right click and paste, then press Enter. There will be no output. Now run the installer command for Orbit. Iβm only going to copy up to the first single quote because βmy passwordβ is just an example. Paste the command into Terminal. If you havenβt changed the admin password on your device, it defaults to the Wi-Fi network password. Type the password, then close it with a single quote, and press Enter. Youβll see output showing it sending the file to the device. Once it finishes, you should see: βInstallation complete. Rebooting device.β The device will reboot. The screen will go black. You should see the welcome logo again. Give it a minute to start up. Once it starts up, youβll notice a thin green line at the top. That means Ray Hunter is running and nothing is detected. Thatβs why itβs green. To view the web interface, connect to the deviceβs Wi-Fi network again. If you forgot the network name, press the Menu button and cycle through until you get to Wi-Fi information. Once connected, go to:
192.168.1.180 If you go there in your browser, youβll see the Ray Hunter web interface. Thatβs it for installation on macOS. You can now skip to the final part of the video. Windows Installation The first step is for TP-Link only. Weβre not using TP-Link. Second step: download the latest RayHunter.zip from the Ray Hunter releases page for your platform. For Windows, itβs Windows-x86_64. Click the Ray Hunter releases page link. Current version is 0.9.0. Scroll down to Assets. Click βShow allβ assets. Look for Windows x86_64. Make sure youβre downloading the one that ends in .zip. The SHA-256 file is not what we need. Select the .zip file. Once it finishes, hit the back arrow. Next, decompress the RayHunter.zip archive. On Windows, you can decompress using File Explorer. Go to Downloads. You should see the RayHunter zipped file. Right click, choose βExtract All,β then click Extract. Once that finishes, it will open the extracted folder. Select the folder. Hold Shift, then right click inside the folder. Choose βOpen PowerShell window here.β Now the next step is to connect to your device. If your device is powered on, tap the power button. Press the Menu button on the top right to cycle through options. Choose 5 GHz or 2.4 GHz Wi-Fi. Press the power button to see details. It shows the Wi-Fi network name, for example Verizon RC400L-2, and the password. I set mine manually for this video. Yours is likely a random string. On your computer, connect to that Wi-Fi network. Select it and connect. Youβll be prompted for the password. If you have connected before, it may be saved. You might see a page pop up asking to activate the SIM. This is because the Mint SIM inside the device wants activation. We wonβt be doing that. Once connected, you can verify by visiting 192.168.1.1 in your browser. You should see the Verizon Orbit login page. Weβre not going to log in, but the default credentials are admin and the Wi-Fi password shown on the device. This confirms youβre connected. Close that tab. Back to the instructions, the next step is to run the installer. Copy the command up to the first single quote. Paste it into PowerShell. Right click will paste. Then type the password. By default, itβs the Wi-Fi password shown on the device. Close it with a single quote. Press Enter. I got a weird error for some reason. I ran it again and everything worked. You should see output like: sending file, device is rebooting. The device will reboot and show the welcome screen again. Give it a minute. If everything worked, youβll see a green line on the top of the device screen. That means Ray Hunter is running and nothing was detected. Back on your computer, connect again to the Wi-Fi network broadcast by the device. Once connected, open a new tab and go to:
192.168.1.180 If everything was successful, you should see the Ray Hunter interface. Thatβs it for installation on Windows. You can now skip to the final part of the video. Linux Installation For context, Iβm performing this installation from a live boot of Ubuntu running off a USB stick. The first step is for TP-Link only. Iβm using the Verizon Orbit, so this is not applicable. Second step: download the latest RayHunter.zip from the Ray Hunter releases page. On Linux, if youβre using x86_64, look for Linux-x86_64. If youβre on ARM, look for Linux-aarch64. Select the Ray Hunter releases page. Current version is 0.9.0. It might be different depending on when youβre watching this. Scroll down to Assets. Click βShow allβ assets. In my case, Iβm on x86_64, so I want Linux-x86_64. Make sure you select the one ending in .zip. The SHA-256 is the file hash. We want the .zip. Download it, then hit the back button. Next, decompress the RayHunter.zip archive. Open Terminal. How you open Terminal varies depending on your Linux setup. Usually you can search for Terminal and press Enter. Change directory to Downloads:
cd ~/Downloads Type ls. Then unzip the file:
unzip RayHunter.zip Start typing RayHunter and hit Tab to autocomplete, then press Enter. Once it finishes, run ls. Youβll see the extracted folder. Change directory into that folder:
cd RayHunter Type ls. If you see the installer in there, youβre in the right spot. Next step is to connect to your device. Press the power button to turn on the screen if itβs off. Press the Menu button on the top right and cycle through the options. Iβm going to use 5 GHz Wi-Fi. Once youβre on that screen, press the power button. Youβll see the Wi-Fi name, for example Verizon RC400L-2, and the Wi-Fi password. I changed mine for this video. Yours will likely be random numbers and letters. Connect your computer to the Wi-Fi network the device is broadcasting. Select it and type the password shown on the device. You may get a prompt to sign into the network because the SIM is unactivated, but we donβt care. You can confirm youβre on the right network by visiting:
192.168.1.1 If youβre in the right place, youβll see the Verizon Orbit login page. Weβre not logging in, but the default credentials are admin and the default Wi-Fi password shown on your device. You can log in later if you want to check options. Close that tab and proceed. Now run the installer. Copy the command up to the first single quote, because βmy passwordβ is just filler text. Paste it into Terminal. Then type the admin password, which by default is the Wi-Fi password shown on the device. Close with a single quote and press Enter. Youβll see output: sending file, logged in, installation complete, rebooting device. The device will reboot. Youβll see the welcome screen. Give it a minute to start up. Back in Terminal, it will show the web interface address:
192.168.1.180 You can click it if itβs a link in your Terminal, or copy and paste it into your browser. Once your device starts up, youβll notice a green line at the top. That means Ray Hunter is running and has not detected anything. Connect back to the hotspot Wi-Fi network. If you donβt see it right away, give the device more time. It can take a couple minutes for the Wi-Fi network to show up. Once connected, visit that IP address in your browser. If everything worked, you should see the Ray Hunter web interface. At this point, installation is complete on Linux. You can now skip to the final part of the video. Final Section: Interface and Next Steps So that was the installation process. Hopefully you were able to complete that successfully. Updating is the same process as installation. Download the new version, run the installer command, and youβll have the new version. The interface is pretty simple. You get details on the current recording. Thereβs also a History section that shows past recordings and any that triggered alerts. Thereβs also a way to test the heuristic detection if you have any doubt that itβs working. You can open the configuration, enable βtest heuristic,β which is noisy, then select Apply and Restart. Give it a minute, then refresh your browser. One note on that test configuration. You might need to reboot the device. Hold down the power button, turn it back on, and then you should start seeing the test warnings. You can expand the entries and see the test analyzer output. Just remember afterward to disable that test mode, and to be safe, reboot the device again. If you do receive a legitimate alert, their FAQ page in the installation guide has details on what and where to send that data if you want to help them out. They can look into it further. If I get any alerts, Iβll make a video analyzing the PCAP. Iβm not too familiar with this exact type of traffic, but I did spend years analyzing packets. Either way, it should be interesting to look at. While this isnβt necessarily fixing any problems, it is giving us visibility. Itβs also just cool, and thatβs more than enough reason to do anything.π Transcript
Transcript
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So, last month I bought a lamp. It has a switch on it. Turns on and off. I did put a dimmable bulb in it, but the switch does not support dimming. So, unfortunately, it’s either off or full brightness. I did start looking into some options on how to make it dimmable without actually changing the switch on the lamp. I found some plugs that you can manually adjust that essentially limit the current going to the actual bulb or to the outlet, which then makes the lamp dimmer. If you turn it up, it makes it brighter. But fiddling around with something like that and then having it statically set did not seem ideal.
Up until this point, I don’t have any home automation. I don’t have any smart bulbs. I don’t have any smart thermostats. But after I started looking into my options with this lamp, it started leading me towards home automation options. Given all the other content on my channel, I obviously don’t want to use something that’s cloud-controlled by someone else. I wanted something I could self-host, control on my own, yet could still have full automation.
And then the more I looked into it, the more I thought it’d be nice to have something where the lights could start turning on at dusk. They could then ramp up in brightness as the night went on. Once it started getting towards the time I wanted to go to sleep, the lights would start to dim down until they turned off. I also thought it’d be nice to have something where it could turn on and off on a schedule when I am not home or on vacation. Whether or not this actually would deter a potential robber into thinking someone’s home, I don’t know, but it seemed like a nice feature to have.
And so what I settled on was using Home Assistant with Z-Wave. Z-Wave is a wireless protocol that lets you control different smart devices if they support Z-Wave. There’s alternatives like Zigbee, which I also looked into. But what I found is that Z-Wave has been around for a while, and they seem to have better security, which was extremely important to me. Regardless of the security, though, I’ll be placing it on a separate VLAN on my switch. This will let me keep an eye just on the Home Assistant traffic and the Z-Wave traffic, along with keeping it separate from my actual LAN traffic.
But what this boils down to is I purchased a lamp, and that gave me an excuse to now look at some more self-hosting home automation that I can explore. And this is where we’re at. But before we get into it, I do want to mention that I truly believe that, given enough time, anyone can pretty much figure out anything. But if you are someone that prefers to spend money in order to save time, I do offer paid consultations. You can head on over to sideburritos.com and then click on the Schedule Consultation button. Whether that’s GrapheneOS, or you’re looking to get into self-hosting, or maybe you’re a business looking to improve your overall security and privacy, I’m happy to help. So again, sideburritos.com, and then click on the Schedule Consultation button.
So, I don’t have an actual top-down camera setup, but I did find out I could clip a tripod to my monitor stand, and it looks pretty good. So, let’s see how this goes.
So, here’s the hardware I mentioned. It’s the Home Assistant Connect ZWA-2. Thank you, Jeff Geerling, for posting a video on this. It kind of led me down that path instead of going with a third-party option.
So, inside the box, it’s pretty straightforward. We have the base. On the back, there’s a single USB-C port along with a reset button. We then have the rather large antenna, a small instruction booklet, and then lastly, a USB-A to USB-C cable, which is cloth braided. Pretty nice, and that’s convenient since Raspberry Pis all have USB-A on them, and that’s what I’ll be using.
And then, speaking of Raspberry Pis, I have this one here. This is just a standard, I think it’s a 4B. It has a janky heatsink on the bottom, along with a PoE hat on it. If you’ve never heard of the PoE hat before for the Raspberry Pi, basically what this allows is you install this on the top of the board, and now that turns this Ethernet port into a port that accepts PoE. So that means you no longer need to use a wall adapter to power the Raspberry Pi. As long as you have a PoE switch, you plug in the Ethernet cable that provides network connectivity along with power, and you can save yourself a cable.
For the actual operating system, I have a microSD card here. I’d prefer to use one of the hard drives I have lying around, but I don’t have an external hard drive enclosure. So, SD card it is.
As far as the smart home devices that I’ll be using with this, I have two smart plugs I purchased. This is a Zooz smart plug, and this is a Minoston smart plug. The reason I got two different ones is the Zooz comes highly recommended. Thanks again, Jeff Geerling, for that one. But this only supports on-and-off functionality, which is not what I’m looking for with my lamp. But this one, the Minoston, does support dimming, so I’ll be using this for my lamp. This one I’ll be using with my Christmas tree for testing. But long-term, I do have a device that I want to be able to turn on and off remotely, and that’s what I’ll be using this for.
On a side note, in case you’re wondering where the Qubes OS video is, that’ll be coming shortly. I had to purchase an adapter so I could record the Qubes OS screen from my current laptop. I tried to film it with a camera. It looked terrible. I wouldn’t want to watch a video like that, so I’m not going to make you watch one like that either. But that one will be out shortly.
So, with the SD card installed, let’s go back to Home Assistant’s website. Get started. Home Assistant does have official hardware, which is pretty cool. I did not purchase one of these. I’m going to be using the Raspberry Pi, but if you don’t feel comfortable using a Raspberry Pi, they do have some plug-and-play options.
Let’s get started with the Raspberry Pi. This is a Pi 4, so it should work. MicroSD card. You do need an Ethernet cable required for installation. After that, it can work with Wi-Fi. I will be keeping this on Ethernet, though, plugged into my PoE switch.
First step: download and install Raspberry Pi Imager. Just had to update Raspberry Pi Imager. Quick, let’s go back to the guide. So, I have a Raspberry Pi 4. Next. What OS do I want to use? Looks like other specific-purpose OS. Looks like they actually have Home Assistant in here according to the guide. Home automation. There’s Home Assistant. We’re going with Home Assistant OS. This one. This is the actual kit that you can buy from Home Assistant, but we’re using the Raspberry Pi, so it’s going to be this one.
Storage. That’s the one I plugged into my computer. Next. Writing. Right. You’re about to erase. I understand.
While that finishes up, let’s check on the next step. Eject the SD card and then start up your Raspberry Pi. I think this is almost done verifying. Currently testing out OBS to record these videos, so it seems a little bit easier to see the windows. Looks good. Finish.
So now, for this setup, since my switch is not over here, I’ll show you what I’ll be doing. I’m going to insert the SD card into the Raspberry Pi. That’s good.
Next, we have the antenna. Get the base out of here. Grab the actual antenna. Get the USB cable.
So what I’ll be doing is plugging an Ethernet cable into here. This USB cable goes into one of the ports. The base gets the antenna screwed into it like so. Pretty straightforward. And then the USB-C cable gets plugged into the back of the antenna. So that’s it. I’m going to plug this into my switch now, and I’ll be back.
So, I just plugged that into my switch. Let’s hope it’s booting up and getting an IP address from DHCP. I’ll log into my switch to see what IP address it got. So, it’s been a couple of minutes, and it looks like the Raspberry Pi did get an IP address. So, I guess it’s started up correctly.
Next is to go to the IP address, port 8123, in your browser. So let’s go there. Continue to site. Cool. Preparing Home Assistant. This may take 20 minutes or more. Interesting. So I’m going to make you watch every minute of this. Just kidding. I’ll see you shortly.
So, we are back. That took about five minutes, I’d say. Are you ready to awaken your home, reclaim your privacy, and join a worldwide community of tinkerers? Absolutely, I am.
Looks like you can upload a backup or restore from their cloud. I’m guessing they offer that as a service. So, I’ll create my smart home. Time to create a user. I’m going to blur out this screen because you don’t need to see me doing this.
Looks like you can select your home location. I’m going to skip this one for now. The country you’re in. Share anonymized information from your installation. No, no, no, no. It’s nice that it’s opt-in, not opt-out, so I’ll give them credit on that one.
Found compatible devices on your local network. Z-Wave. Cool. Bluetooth. I’m assuming Z-Wave uses that to pair with.
Finish.
My user, Josh. Let’s see. Settings. Devices and Services. Home Assistant. Connect ZWA-2. That’s it. Looks like it’s discovered. I do want to add it. In a few steps, we’re going to set up your home adapter. Home Assistant can automatically install and configure the recommended Z-Wave setup. Let’s customize it, because why not.
Is your network new, or does it already exist? It is new. Created configuration for Z-Wave JS. Finish.
Failed setup. Failed to connect. Cannot connect to blah blah blah. Okay. Don’t know why that is.
I just reloaded it, and it did find it. So I guess it did work. Or maybe it took a little bit too long to start up, so it couldn’t see it.
LED. If I toggle it, it does turn off. Okay. I will say the device does look pretty cool. I’ll try and include a picture here in the video. It kind of looks like a small airplane tower.
Firmware update available. Okay, let’s just update it because we’re here. I’m always a big fan of a changelog, so it’s nice they include that.
So, I didn’t see the actual antenna flash at all, but I just noticed that the installed version and latest version now match. So I’m assuming it’s good now. Refresh the page. Up to date. Z-Wave info. Okay.
I’m going to look more into this after. I’m not going to do it right now, but I do want to try and connect one of the outlets that I purchased.
So, overview map. Not in Amsterdam, but that’s the default location. Energy. Okay. Has to-do list overview. Media. Guessing what it can save from devices, or if you have cameras hooked up, which I might try and pair some home security cameras I have to this.
Okay, so just looking so far, I will say it’s a little confusing at first. Okay, here’s the plus button. Want to add a device. Add a Z-Wave device.
Only use your camera to scan QR codes when using a secure connection with the app or over HTTPS. Okay. Well, I’m not going to scan with my camera, so I guess I’ll use the QR code manually.
Let’s get back to the top-down view quick. Every smart device does have a QR code on it. Let me not show these on camera since that would be a security issue. Actually, this one, yeah, on the side here, we do have a QR code, which I’m not going to show you.
But here’s the plug. I think this is a physical power switch. So it’s nice that even though it’s a smart device, you can still use it as a dumb device, which is nice in case my home hosting setup goes down and I can still turn a lamp on and off.
Okay, looks like I need to scan it with my phone so I can get the QR code, since the QR code does not list it. Okay, so I scanned it with my phone. I think this is about 100 characters. I’m just going to send it to myself on Signal quick so I can copy and paste it, because I’m not typing that in.
So I guess long-term, it would be good to put an HTTPS proxy in front of this or use the app so that you don’t need to do this manually every time you want to add a new device. Either way, it’s always a good idea to use HTTPS. So I will be adding that later. I run Nginx Proxy Manager on my home hosting or self-hosting setup, so I’ll just add it to that.
So here’s the code. It’s going to be blurred out on the screen, but it is massive. Next. Indoor smart plug. I guess it detects that from the code. Let me plug this in, though, so it can be on.
So I just plugged in the smart plug. I heard a relay click inside of it. This is a long-range device area. I don’t have any yet. I guess there’s some default ones. Just put living room. Add device.
If your device is already turned on, you might need to turn it off and on again. Okay, it’s searching for the device. I guess I’ll try turning it on and off.
Just turned it on and off. It should be scanning for it. Looks like it did find it. This device is currently being interviewed. It may not be fully operational. Okay, definitely got some stuff to learn about Z-Wave and Home Assistant. This is cool.
The plug looks like it gives some sensor details about it. Let me plug in my phone to this. So, I wish I had something better to visibly show that the outlet is on or off based on the dashboard here, but here’s a phone. I have a power brick plugged into the outlet and then plugged into a USB-C cable. So let’s plug it into the phone. Looks correct. It should be off.
And I’m guessing controls. If I toggle this, then the phone should turn on.
Heard the relay click, and the phone is now booting up. So that did work. We can see some stats here. Electrical consumption: 0.4 amps, 2 watts. The phone is currently charging at 9 watts. Okay, looks like it is working.
And if I turn this offβlet me justβokay, there it is. Heard the relay click again in the outlet, and it’s no longer charging.
So one thing I was worried about is the latency from when I toggle something to when the actual device reacts to that action. It seems almost instant. If I click it, I feel like I’m hearing, in real time, the outlet going on and off. So it does seem near instant that this is working.
I’ve seen some complaintsβmaybe it’s some other protocols or other devicesβwhere there is some latency, which can be kind of annoying because you’re wondering, did the actual action work? Is your setup not working? Is the device not working? But with this being instant, you can tell pretty quickly.
So overall, I think that setup was pretty straightforward. It’s always pretty iffy when you’re dealing with hardware and software how things are going to work, but it seems like the Home Assistant antenna worked very well with Home Assistant, as I would hope.
So I’m going to go and play with this some more, work on some configurations, and I’ll come back in the future with another video on what I have set up and some good things and maybe bad things I find out about it.
So if you do want to set this up yourself, I do think it was pretty straightforward. Again, Home Assistant does have some first-party hardware that you can use. So if you’re looking for something that might be a little bit better than a Raspberry Pi or a little more straightforward, then that is an option.
So if you have any questions or comments, or any tips on using Home Assistant or some cool things that you set up, feel free to leave those down below, and I’ll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
I attended Defcon 33 a few months ago, in August of 2025, in Las Vegas, Nevada. It’s always an enlightening experience. So, if you ever have the chance to go, I highly recommend it. To those that saw me there and came up to me and thanked me for my content that I publish, thank you for that. Your words truly meant a lot to me.
But before we get into it, I want to mention that I offer paid consulting. I truly believe that anyone can figure out anything given enough time, but there are some people that prefer to save time by spending money. And if that’s you, I am happy to help. You can find out more at sidabritos.com by clicking the “Schedule Consultation” button.
This year, I saw a presentation by Yoav McGidd. I hope I pronounced that correctly. That gave me the same gross feeling I had when I made my initial video in August 2021 about switching to GrapheneOS. Here’s the TL;DDR of what that presentation talked about. It covered how Apple’s AI ecosystem is sending WhatsApp, iMessage, and other app data of Apple users when they are using the “Hey Siri” feature, and the user has no control over this.
Besides sending the message data that was being used to transcribe what the user had said, it was also sending what media the user was currently listening to in their browser. I guess they need that for context. It was also sending a list of apps installed on the user’s machine, including a list of apps from a virtual machine the user had on the host. The presentation has way more details on this, so I suggest you look at that. I also saw that Defcon published the talk yesterday on YouTube, so if you want to watch that, I will link it down below.
But after seeing this presentation, I was just grossed out, for lack of a better term. I don’t use Siri on my MacBook, but I know there’s other privacy invasive stuff running, even though I filter my network traffic with Little Snitch and have most of the Apple features and apps disabled. And before you start typing that comment, yes, I know I talk about GrapheneOS and that’s what I use, so using macOS makes me a hypocrite, a sellout, trying to think of the other names that I’ve been called, but it’s fine. I get it. No hard feelings. It’s what worked best for me at the time.
But times are changing. And add in that Tim Cook is selling out to Donald Trump, giving him a gold bar trophy, because that’s what I do with my friends. We have a bunch of Silicon Valley nerds brown-nosing the current administration and going to fancy dinners. We also have Apple doing whatever they can to appease the current people in power. And regardless of which side you fall on, tech companies being in bed with the government is not normal, at least in the U.S., at least not this blatantly.
So, what I’m going to be doing is trying to migrate to Qubes OS, which is a reasonably secure operating system. I mean, if this guy likes it, then it’s got to be kind of good. Where Qubes OS is different from a regular operating system is that they leverage Xen-based virtualization to allow for the creation and management of isolated compartments called cubes. Basically, what that means is that every app or compartment is a virtual machine which keeps it separate from others.
I’ve read and heard that the learning curve can be pretty steep for Qubes OS. And in the past, I’ve tried other desktop OSes like Fedora, Pop!_OS, Ubuntu, Debian, but none of them did it for me. This time, I have the motivation behind me, so I figured I would try and use the best available option that I knew of. So, I went out and purchased a 2018 T480 ThinkPad for $25 shipped off eBay. I wanted to use something that was listed as compatible with Qubes but not spend a ton of money. I’m not recommending you go out and buy this laptop. I just wanted to find the cheapest option available. If Qubes OS ends up working for me, then I’ll switch out to something else in the future.
There are a few things I want to mention about this laptop. First off, it was one of the first laptops I used at my first job that we would roll out to employees. And like I said, this is a 2018 laptop, but somehow it came with some amazing features like an integrated, I don’t know if you can see it, slide for the webcam to cover it. So that’s pretty awesome. I don’t know why that’s not a feature anymore.
The keyboard’s also pretty decent and has some nice tactile feedback. The touchpad is decent as well. It also has the little nub in the center that you can use for the mouse. The red nub is actually missing from this one, but I could replace it if I wanted to. In addition, it has a removable battery, so that’s pretty handy as well. And the ports on here also impressed me. So again, 2018 laptop, almost eight years old at this point, it has two USB-C ports along with a dock connection port. And on the other side, it has an Ethernet port, a full-size SD card slot, two USB-A ports, an HDMI port, and a headphone jack. So, it was pretty refreshing to see all those ports again on a laptop. I miss those days, along with an integrated webcam cover.
So, I’m going to be recording my experience from the start with this process. It’s not going to be like my current videos where I test everything out and make a polished guide demonstrating how to do things. I’m going to share my experience from the perspective of someone who has never used Qubes OS before and document that process. So, a little bit different format, but I think it’ll be interesting.
I know it’s not realistic to expect I’ll get everything migrated over to a five-year-old laptop. I’ll probably continue my video editing on macOS, but everything else is fair game. So, if you have any suggestions or feedback on getting started with Qubes OS, feel free to share that down below, and I’ll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So today I want to talk about the private space feature on GrapheneOS.
But before we get into that, I want to mention that I do offer paid consulting. I truly think anyone can figure out anything given enough time, but there are some people that prefer to save time by spending money β and if thatβs you, then Iβm happy to help. Whether youβre an individual just getting started with GrapheneOS, youβre looking to get into self-hosting, or maybe youβre a business looking to improve your overall security or privacy β if you want to find out more, you can head on over to sideofburritos.com and click on Schedule Consultation.
I want to start by going through the official announcement first by the GrapheneOS team on the discussion forum. I realize this was posted almost a year ago, and some things have changed since the initial announcement, but I still think itβs beneficial to go through.
GrapheneOS and the Private Space Feature
So, GrapheneOS fully supports the private space feature on Android 15, which is essentially a separate user nested inside of the owner user. This last part has already changed β the private space feature is now available in all users, not just the owner profile anymore.
The team strongly recommends it as a replacement for a work profile managed by a local profile admin app. It has better OS integration and isolation. So if youβre using something like Shelter on your phone currently to create a work profile, this is a great replacement.
The private space is an isolated workspace profile for apps and data, similar to both user profiles and work profiles. All three forms of profiles have entirely separate VPN configurations, which is very useful even if you are connected to the same VPN, since exit IPs can be separate. That part might sound a little confusing, but Iβll explain that better in the demo.
All forms of profiles have separate encryption keys. You can keep a private space at rest while the owner user is logged in, just as you can with a secondary user. This was a big reason I always liked using secondary users β you could end the session on that user profile and now itβs at rest, as compared to the owner user profile, which you need to be logged into in order to use your device.
Now, you can have a single profile setup. You can use the owner user profile, have a separate private space in there, and then put that private space at rest if you have something running that you donβt always want running. Before, you needed a secondary user profile for that.
The private space makes it easier to share data than users. The clipboard is shared, but we could add a setting for it β they have added a setting for that, which Iβll point out. All the features, including contact scopes, storage scopes, and sandboxed Play Services, have full support of private space. So if you use any of those features and youβre concerned about them not working in private space β they do work.
Currently, I think a lot of users use a separate user profile if they want to use sandboxed Google Play. And while this does provide great isolation, it can be cumbersome to switch to that separate user in order to use apps. Now, with private space, you get the same benefit of isolation, but itβs much more convenient to use those apps in the same user profile you always use.
I realize a lot of this might sound confusing in the way Iβm explaining it, but hopefully thatβll be cleared up in the demo. So letβs get into that.
Setting Up a Private Space
Here I am in my owner user profile on a Pixel 7 running GrapheneOS. The first thing weβre going to do is set up a private space β and again, this works in any user profile, so if youβre in a secondary user, you can follow this same process and set one up there.
Go into Settings, scroll down to Security and Privacy. At the bottom, youβll see Private Space β tap on that.
The screen will then prompt you for your user PIN, so type that in. Here we have some details about the private space β I suggest reading through that. At the bottom, thereβs a warning:
βPrivate spaces are not suitable for apps that need to run in the background or send critical notifications, such as medical apps.β
This is because notifications and background activity are stopped when your space is locked. As the warning states β if the private space is locked, notifications will not work. But if itβs not locked, notifications should work. Do your own testing before depending on it for something critical to your health or well-being.
Once youβve read through that, tap Set Up at the bottom right. Once that finishes, youβll be prompted to choose the lock method for your private space. You can either use your screen lock or choose a new lock. Iβve been using my screen lock, but if you want it different, go ahead and do that.
Tap Use Screen Lock and itβs all set. It tells you where to find it. Click Done, and as you can see, Iβm now in the app drawer. Swipe up from the home screen and youβll now see the private space at the bottom β on the right side, youβll see the lock icon, which means itβs currently locked.
Tap on that, enter your lock screen PIN or password, and once entered correctly, you are now presented with the private space.
Navigating the Private Space
A couple of things β when itβs unlocked, you can swipe up or go back, and it stays unlocked. Tap the lock button to lock it again. Remember: when the private space is locked, those apps are not running. So if you need notifications from any apps in your private space, those will not work while itβs locked.
Youβll notice some apps already installed β these are the same default apps that come on GrapheneOS when you install it. Each app installed in the private space has a small shield-and-key icon at the bottom right β that means itβs installed in the private space.
There are a couple of ways to install apps into the private space. If you tap the Install button here, it opens the GrapheneOS App Store. From there, you can install Google Play Store and Google Play Services. This is great for people currently using a separate user profile for apps that require Play Store. You get that same separation with the convenience of being able to lock or turn off the private space when not using it β something you couldnβt do with apps installed in the owner profile without powering your phone down.
Private Space Settings
Tap the gear icon next to the lock icon β these are the private space settings.
Private Space Lock β You can change it so it doesnβt use the device screen lock.
Lock Private Space Automatically β By default, itβs set to Every Time Device Locks. If you want it to run continuously in the background, change it to Only After Device Restarts.
Hide Private Space β By default, this is off. Turning it on hides the private space from the app drawer. To access it, go to Settings β Security and Privacy β Private Space β Unlock. I keep this off since Iβm the only one who uses my device.
Cross-Profile Shared Clipboard β The default option allows sharing between the main user and private space. Itβs up to personal preference whether to keep or restrict that.
End Session Immediately on Lock β Disallows delayed locking of storage. I donβt fully understand this option, but it seems safe to enable.
At the bottom, youβll see the same warning from setup β again, test notifications before relying on them.
Installing Apps from the Main Profile
Going back to Install Available Apps, tapping it shows a list of all apps installed in the current user profile. Installing apps to the private space is as simple as toggling the switch next to the app. For example, if we enable Molly, weβll now see it in our private space.
Default apps are separated by a horizontal rule, and anything with the small icon in the corner is in the private space. This is helpful for distinguishing which version youβre in β for example, if you have Signal installed in both, the icon tells you whether youβre in the private space or the main profile.
VPN and Profile Isolation
All three forms of profiles have entirely separate VPN configurations. For example, in my owner profile, I have ProtonVPN installed. If I connect there, that VPN only applies to the owner user. If I go to the private space and check my IP in Vanadium, it will show my home or cellular IP.
To apply a VPN to the private space, install and sign in to your VPN there separately. While it might sound cumbersome, itβs actually a benefit β you can have different exit IPs or countries per profile. This is the same behavior as secondary users on GrapheneOS.
Final Thoughts
Iβve been testing out the private space feature for the past few weeks, and itβs been working well. Itβs much more convenient to use than a separate user profile. The only app I noticed some oddities with was MySudo β some calls and texts behaved oddly, at least notifications did.
I reached out to the MySudo team, and they said it should be supported in any profile type. Iβm going to continue testing before fully committing and deleting my secondary user. But I think the private space is a great option for a lot of people, especially if youβre just getting started.
It makes the transition much easier than having a separate user, where you need to switch whenever you want to use those apps or get notifications.
Looking back at my notes, I covered a lot of information in this video. Hopefully it didnβt come across as too confusing, and it can serve as a good place to get you started. If youβve been testing the private space feature, feel free to share your experience. And if you have any questions or comments, feel free to leave those down below β and Iβll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So today I want to talk about one of the biggest features I think Graphine OS has released in a long time.
But before we get into that, I do want to mention that I offer paid consulting. I truly believe that anyone can figure out anything given enough time, but there are some people that prefer to save time by spending money. And if that’s you, then I’m happy to help.
Whether you’re someone just getting started with Graphine OS or you’re looking to get into self-hosting or maybe you’re a business looking to improve your security or employee privacy, you can find out more by heading on over to sidebretos.com and clicking the schedule consultation button.
But what this feature is is security preview releases. Security preview releases provide early access to Android Security Bulletin patches prior to the official disclosure. Their current security preview releases provide access to the November 2025 and December 2025 patches for the Android Open Source Project.
They recommend enabling this, as do I. The only difference between regular releases and security preview releases are the future Android Security Bulletin patches being applied with any conflicts resolved.
The downside of the security preview releases is that they are unable to provide the source code for the patches until the official disclosure date. The reason for this is that the OEM they are working with is allowing them to release these as binary only, which means that they are technically closed source even though the rest of the operating system is open source.
If we scroll down, the Graphine OS team has also posted some more details about it. The terms with their OEM partner are not really under an NDA, and neither is which OEM they are working with, but they donβt want to publish which OEM it is until an official announcement with them.
On a side note, that’s pretty exciting. That means they found an official OEM partner to work with, and I’m assuming that means they’re going to be working on hardware with them. I havenβt heard any more details about it at this point, and this is likely the reason why.
Now, to cover some of the concerns that I’ve seen about this β yes, technically these early security release preview patches are closed source even though the rest of the operating system is open source. Personally, I have no concern about this. These are typically tiny pieces of code that fix vulnerabilities or exploits.
I’m sure some people will comment that this is bad and evil that the code is closed source right after they finish writing a message on WhatsApp.
As far as enabling this goes, once you are in your owner user profile on Graphine OS, go into Settings, scroll down to System, and then select System Updates. If you’re on a recent or the most recent release of Graphine OS, you’ll see a βReceive security preview releasesβ option. It is disabled by default.
If you toggle that, you can either wait a little while for the phone to check for updates by itself, or you can select βCheck for updates.β Youβll now see thereβs a new update installing since you enabled that option. That update will download and install the security preview release of Graphine OS.
If you’re wondering how these releases work, theyβre actually going through significant effort and building two variants of each release. The 2592500 build is the non-security preview, and the security preview release is 01. Once you enable it, your phone downloads the 01 version.
Their plan is to keep it off by default with a new page added to the setup wizard, but theyβll recommend turning it on. Once the embargo ends, they plan to publish what they used, so it will still be open source β just delayed.
So, if you have any questions or comments, feel free to leave those down below.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So today I want to talk about CalyxOS and why it is no longer safe to use.
Earlier this month, on August 1st, 2025, the Calyx Institute published a letter to their community. I will link this down below, but I want to highlight a few important parts of it. I would still suggest reading the entire thing yourself for more details.
The first thing is that Nicholas, president and founder of the Calyx Institute, has left the organization to pursue other projects. Additionally, Sirayu, I think thatβs how you say it, the CalyxOS tech lead, has also departed from the project. So basically, two high-level and important people at Calyx Institute have left recently.
In light of that, they have decided that they are going to define some priorities, which include upgrading the tech infrastructure, supporting CalyxOS development, stabilizing update release cycles for their 25+ supported devices, and revising and updating documentation, wikis, and other user guides. Overall thatβs a good thing. Itβs never a bad thing to do, but the main issue comes here.
After conducting a thorough inspection of the work required for successful completion of the above priorities, they determined that it may take up to four to six months for them to provide the level of security maintenance they aim to deliver. They also state they will be switching to new signing keys along with the overhaul of the signing and verification process. As a result, current CalyxOS users will not be able to receive further security software updates until this process is in place. Given the potential risk posed by the pause of maintenance and development, it is logical that they stop providing options to install CalyxOS for now, which I applaud them for. But they went back on that decision a little while later.
Just to go over this first: we have two high-level individuals that have left, and they have decided to pause updates for the next four to six months. That means that when the AOSP, the Android Open Source Project, puts out updatesβwhich includes security fixesβCalyxOS will not be receiving those. As of the time of recording this, CalyxOS is stuck on the June 1st, 2025 patch level. That means there are already two remotely executable vulnerabilities present in the latest release of CalyxOS, and it may take four to six months for them to provide any updates. More and more vulnerabilities will be found in Android OS, and those will not be fixed or patched.
Now you might be saying, βIβm not an important individual, so I wonβt be a target.β First of all, I want to say you are important, and thanks for being here. But besides that, it doesnβt matter if you are a target or not. Once these vulnerabilities are weaponized, they are launched at mass scale. Even if you arenβt a direct target, if your device is vulnerable, it could be compromised.
You see this all the time with routers people have in their homes. Theyβre compromised on a mass scale and used in DDoS attacks and things like that. So it doesnβt matter if youβre not a targetβif your device is vulnerable, then you are not safe.
And even if CalyxOS does stick to the four-to-six-month timeline theyβve laid out, they are planning on rotating the security keys. For some reason theyβre doing it in a manner thatβs disruptive, which will require users to reinstall CalyxOS from scratch. That doesnβt make sense, because there are non-intrusive ways to do it, at least for most of the keys. You can read into that more or do your own research. Regardless, if they do come back, youβre still going to have to reinstall your device, which is not ideal.
Then, four days later on August 5th, the CalyxOS team posted another update to the article. They said, βFirst we want to assure you that we have no reason to believe the security of CalyxOS and its signing keys have been compromised.β They also mentioned that for the time being, current CalyxOS users will not be able to receive further software security updates until the new security protocols are in place. Good on them for being honest, but without security updates this does not guarantee the level of security they strive forβespecially when global threats to privacy and human rights are at a critical moment.
The last thing is that, due to overwhelming feedback from the community, they decided to make the images publicly available once more. This is different from when they hid the βGet CalyxOSβ button on their site originally. Now, while they do have a banner saying CalyxOS releases are paused, you can still install it on your device. Itβs okay that they have a very obvious message there, but even they recommend that this is not a recommendation to migrate to CalyxOS now.
So to summarize: CalyxOS is no longer safe and secure to use. If you are using CalyxOS and you have a Google Pixel that is supported by GrapheneOS, then my recommendation is to install GrapheneOS and use that instead. Even when CalyxOS was being updated, that would still be my recommendation.
If you have a device that is not supported by GrapheneOS and you want to get one, check out the A versions of the Pixels. Those are usually more affordable, and you can find them significantly discounted when used on eBay or other sites. On my website, sideofburritos.com, I have a few options for people in the United States and also for international buyers.
If you want to hear more from me in the meantime, I have a podcast called In The Shell. You can find it at intheshellpodcast.com. I am planning on launching season three shortly, so stay tuned for that. I also have a monthly newsletter you can sign up for at sideofburritos.com.
And if you have any questions or comments, feel free to leave those down below, and Iβll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
And everything we do now lasts forever. Not because we want to remember it, but because we’re no longer allowed to forget. So, I saw this clip a few days ago, and I know that it’s about 5 years old at this point, but the way that Snowden phrased it really stuck with me. I typically think about privacy from, I want to protect my data from these big companies or from governments. But when you look at it from the perspective of everything we do today is permanent, and it’s not because we want to remember it, it’s because we are no longer allowed to forget it. And when I heard that and started thinking about it, it really stuck with me about why I do the things that I do to try and preserve my privacy.
And the reason I’m making this video is because just yesterday I got this email from Claude, or Anthropic. By the way, I’m not a privacy purist when it comes to using AI. I try to use it responsibly, not share my data with it. It is helpful. I’m in the tech field, so got to use it. But in the email they sent, under the updates to data retention, your choices and controls: if you choose to allow us to use your data for model training, we will retain this data for 5 years.
In the back of my mind, I already knew that companies keep your data for an indeterminate amount of time, whether it’s for legal purposes or for their own analytics. But to see it spelled out so clearly and sent to all their users really just enforced that we are not allowed to forget anything anymore. Do you remember what you were doing last week, or last month, or what you were going through 3 years ago? Maybe you’re using AI because you had a question about something or some health condition, or maybe you were going through something, or a breakup, and maybe you had no one else to turn to, so you used your chat.
Whether or not you agree with that situation or using it for that purpose, people do, and people have, and are using it for that. But not everyone’s aware that that data is then being stored and used and retained, and there is a permanent record of that. Whether or not this little toggle works, that’s beside the point. But it really just got me thinking about how little privacy and ephemerality is left in daily life.
I mean, as you’re watching this video, wherever you are right now, look around the room. Is there an Alexa sitting in the corner? Do you have an iPhone that has Hey Siri turned on so that it can be there whenever you need it? When you walk around your neighborhood, are there Ring doorbells watching every step you take β where you go, what time it was at, who you were with, what you were doing? These recordings are all being uploaded to the cloud. They’re being transcribed. They’re being stored. They’re being associated with you. Whether or not that’s for marketing purposes or just for general surveillance.
And if that’s not enough, we even have governments at the highest levels doing whatever they can to surveil their citizens’ private communications. We have the EU with chat control in their attempt to protect the children. And in the US, we have police using Flock, which are these little cameras on the back of their cars that record license plates and tell them real-time locations of vehicles. The government wasn’t able to conduct this type of surveillance themselves due to regulation. So instead, they use a private company to do it. And now there’s a national database of Americansβ movements in their vehicles. And you couple that with AI, which is being used to report people to police if they detect suspicious movements, all in an attempt to predict crime and stop it before it happens.
And then we have officials at the highest levels spreading FUD β fear, uncertainty, and doubt β to convince citizens that things are so dangerous that we need to weaponize surveillance against them, with companies like Palantir having access to all of our data in order to keep you safe and prevent violent crimes.
I think we’ve become conditioned to a certain level of surveillance and kind of assume that all of our communication is recorded and monitored, which is not a great way to live. And just because we’ve become accustomed to it does not mean that it’s right. So one suggestion I would give, which is something that I’ve done, is at least try and make your home a place where you can have private, unfiltered conversations, share ideas, without having something listening in the background. Unplug Alexa, turn off Siri. There are a couple small things you can do to make sure that you can restore your right to ephemeral communication and not have to worry about that being stored and used against you someday.
I have a few more videos I just finished recording. I just need to finish editing those before I’ll publish them. This one was a bit more timely, which is why I’m releasing it first, but stay tuned for those coming up in the future. If you want to hear more from me in the meantime, I do have a podcast called In the Shell. You can head on over to intheshellpodcast.com to find out where to listen. And I also have a monthly newsletter that I send out, which you can sign up for at sidebretoritos.com. And if you have any questions or comments, feel free to leave those down below, and I’ll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
Just a few quick updates before we get into it.
I send out a monthly email newsletter β if you want to sign up for that, you can go to sidecideros.com, throw your email in the box, and hit subscribe. While you’re there, you can also check out my podcast, which is called In the Shell. You can find out where to listen at intheshellpodcast.com.
Back on sidecideros.com, I added a small phone icon at the top. If you click on it, it takes you to a page with an up-to-date list of all the apps I use on my Google Pixel running GrapheneOS. So if you’re just getting started or you’re curious about what I use, you can check that out and use it as a reference.
About five months ago, I published a video called The Big Problem with Bitwarden Backups. TL;DR β I was migrating my self-hosted Bitwarden instance to a new server. I set it up, imported my backup (exported using the web interface), and everything seemed fine. But shortly after, I needed an attachment from my vault β I think it was a PDF β and realized that none of the attachments had been imported.
After digging into it and finding a forum post, I learned that Bitwarden backups didnβt export attachments at the time. Fast forward to now, and it looks like theyβve fixed that β they even published a blog post about it. Attachments are now included in backups, which is great!
That said, I still donβt use Bitwarden. As Bush once said (sort of):
βFool me onceβ¦ shame on β shame on you. Fool meβ¦ we can’t get fooled again.β
(Yes, that was a joke.)
Even so, I still recommend Bitwarden for 99% of people. I think itβs the best option if you need a cloud-hosted, centralized vault β especially if youβre managing passwords for multiple people in your family and donβt want to be solely responsible for your data.
As for me, Iβve reached a point in my self-hosting journey where Iβm trying to simplify my setup. Bitwarden running in Docker containers is fairly straightforward, but there were some backend elements I wasnβt entirely comfortable with. A few times during updates, the service wouldn’t come back up right away. I had to troubleshoot, figure out what changed, make updates, and get it running again.
For something like a password manager, that kind of downtime can be stressful. Thatβs why I moved to KeePass.
One of the benefits of KeePass is that your vault is just a single file. That means you can back it up by literally copying it to a flash drive. If you ever need to restore it, you just open the file with KeePass β no need to set up a new instance, import a backup, and go through the login process. You can access your vault from any computer or phone with the app installed. That simple file structure is a big plus in my book.
Quick note before I continue: If you havenβt self-hosted anything before, your password manager shouldnβt be the first thing you self-host. Start with something less critical, get your backup plan in place, and then maybe consider self-hosting your password manager.
So back to KeePass β itβs simple. I use KeePassXC on desktop and KeePassDX on Android. One thing to keep in mind is that unlike Bitwarden (which provides a complete ecosystem from the same company), KeePass is more fragmented. But once everything is set up, you donβt really have to think about it.
The interface is straightforward. I really like the password generator β you can choose between passwords and passphrases, and it includes a default word list (you can add more if you want). I do wish it had a username generator, though β thatβs one feature it lacks.
Creating new entries is simple. You can attach files, and since everything is stored in that one file, you donβt have to worry about exporting attachments separately.
KeePass also supports MFA. I use YubiKeys for this β specifically the 5C model. Every time you make a change, KeePass prompts you to touch the YubiKey for confirmation. I also have a Nano YubiKey that I leave plugged into my computer, which makes it more convenient. This adds a layer of protection against automated attacks since physical touch is required for authentication.
Thereβs a browser plugin for KeePass, but I found it a bit clunky and stopped using it. Instead, KeePass has a feature called Auto-Type. You select an entry, click Perform Auto-Type, and it types your credentials into the active window. I donβt personally use it β I just copy and paste.
On my phone, I also avoid keyboard integration β I just copy and paste there as well, and it works fine for me.
You might be wondering how I sync across devices now that Iβm not using a centralized setup. I do 95% of my work on my laptop, so I only make changes there. Then every few days, I manually transfer the updated password database to my phone and tablet using LocalSend.
You could sync your KeePass database to a cloud service and install the client on each device β I actually have mine synced to Seafile, which I also self-host β but I still prefer the manual method. It keeps things simple, and I havenβt had any issues with it.
So while I still think Bitwarden is a fantastic choice for most people, if you’re into self-hosting, KeePass is absolutely worth checking out.
If you have any questions or comments, feel free to leave them down below β and Iβll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
Today, I want to talk about Bitwarden. Let me start by saying that I think it’s a great password manager and a solid option for many people. I’ve been self-hosting it for the past two years, but there’s one major feature missing that could potentially cause problems for users, just as it did for me.
For the past two years, I’ve been hosting Bitwarden on a Raspberry Pi, along with a few other containers. Recently, I wanted to simplify and consolidate my setup, so I moved Bitwarden, along with the other containers, to an existing Mini PC I had. I got the containers up and running on the new host, and the next step was to restore the backups I had taken. Everything went smoothlyβbackups for the other containers restored perfectly. When I restored Bitwardenβs backup, everything seemed fine. I signed in on my other devices, ensured syncing was working, and verified all my passwords were intact. Perfect.
About a month later, everything still looked good. Confident in my setup, I decided to format the drive the Raspberry Pi was using and deleted the backups I had for it. Then, of course, Murphyβs Law struck. I logged into my new Bitwarden instance to check on some documents I had uploaded, and to my surprise, they were gone.
This leads to the major feature Bitwarden is missing: the ability to export attachments when you back up your vault.
Let me walk you through what happened. In my self-hosted instance, I had to use a cloud-hosted Bitwarden Vault to get a license for the self-hosted subscription. So, I decided to test this feature in the cloud-hosted vault. Hereβs what I found:
When you try to export your vault, you have a few optionsβJSON, CSV, or encrypted JSON. I selected JSON, confirmed the format, typed in my master password, and exported the vault. When I looked at the exported file, it was clear something was off. The file size was only 636 bytes, even though the test entry I uploaded included a 40 MB attachment.
Iβll take some responsibility hereβthere were red flags I should have noticed. The file was too small, and JSON is unlikely to contain encoded attachments due to size limitations. There were no additional folders or files for attachments, just a single, tiny JSON file. I should have realized this, but I was working casually and didnβt double-check.
To make matters worse, thereβs no warning in the Bitwarden interface about attachments not being included in exports. The only mention of this that I could find was in the “Export Vault” help document, which states: βVault exports will not include file attachments, items in the trash, or sends.β While they do technically warn you, I think this information should be far more prominent.
Bitwarden has no problem including warnings in other parts of the app. For instance, the “Security” tab highlights warnings about changing your master password or enabling two-step login with yellow-highlighted alerts. A similar approach for export warnings could save users from losing critical data.
Needless to say, I lost backups of SSH keys, important documents, and even photos of identification that I had stored securely in Bitwarden. Itβs a harsh lesson in the importance of keeping local backups, which is a topic Iβll cover in a future discussion.
After realizing this, I started searching to see if others had faced the same issue. I found a Hacker News thread discussing the exact problem: Bitwarden does not export attachments in backups. The thread linked to a community feature request for this functionality dating back to May 2018. Thatβs nearly six years, and the feature still hasnβt been implemented.
Some commenters suggested contributing to the open-source project by submitting a pull request to implement the feature. While thatβs a fair point, itβs also worth noting that file attachments are a paid feature. If youβre paying for the product, you might reasonably expect such a basic feature to be included without needing to develop it yourself.
All this is to say: if youβre using attachments in Bitwarden or considering it, Iβd recommend either avoiding them or ensuring you save local copies of any files you upload. Personally, I might use this as an opportunity to explore other options like KeePass and see if they better meet my needs.
I hope sharing this experience helps someone avoid losing their attachments in Bitwarden. If you have any questions or comments, feel free to leave them below, and Iβll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So, as I’m recording this video, it’s currently 5 days before Christmas. When you’re watching this, it will be 2 days before Christmas. 5 - 2 is 3. Therefore, I want to talk about my three favorite Linux commands. These might not be my favorite Linux commands, but they are my most used ones.
The first one is dig, and what that’s useful for is resolving hostnames to IP addresses or looking up specific DNS records. So, in the basic sense, we’ll just do a dig on sideofburritos.comom.
We can see here in the answer section, we have the two IP addresses that correspond to the two A records I have assigned for my domain. If you want a cleaner output to only show the answer section, you can add +short on the end. Now, we only get the two IP addresses instead of everything else.
Another use of this, which I was reminded of yesterday when someone asked me what email provider I use for my site sideofburritos.com domain, is if we do another query and add MX on the end of itβwhich is short for mail exchangeβit will do a query for the mail exchange records associated with my domain. So, if we run that again, here’s the response. We can see it’s mail.protonmail.ch and mx.secprotonmail.ch. Those are the mail servers that ProtonMail uses for custom domains.
Another example: if we do the same query for yellowball.fm, which is the podcast hosting platform I run (if you’re looking for hosting), we can see here mail.tutao.de. Tutanota changed their name to “Tuta” so it’s easier to say, but they haven’t changed their records. Anyways, I use Tutanota for that. But that’s a quick way to see what email provider someone might be using to send emails. You can use this to do some sleuthing and get other information about a domain, but those are the main two ways I use it for queries.
The last way that I use it commonly, and this is mostly for troubleshooting, is adding +trace. If we scroll up to see the output: fun factβdomains actually have a dot or period on the end of them. Let’s just change that to make it a bit more clear. You don’t need to type the dot; it’s just assumed, but in all reality, it is there. Domain names are read from right to left, so that’s why we can see here the first query is for . (dot), which specifies the root. That’s why we get the root name servers back in our response.
Next, we have .com, which is why we see the com. nameservers. That’s the next one that we need to query to get the response for who has cab.bos.com. So once those are queried for cab.bos.com, they reply with the authoritative nameservers for the domain, which we can see here: cab.bos.com.. We have the NS record nameservers, and we have the two authoritative nameservers that I have configured for my domain.
Then lastly, those are queried, and what those reply with are the associated A records for our initial query that was sent. So, before, when we were running a simple dig sideofburritos.comom, all this was happening in the background, but you weren’t seeing it because we didn’t include the +trace. So, you might be wondering why this is useful. Well, first off, I think it’s just cool to see thisβI like DNS a lot; I think it’s a very cool protocol.
But it’s also useful for troubleshooting. Let’s say you’re trying to figure out why your domain’s not resolving. If you run +trace and you get to here but get nothing else after that, it means something’s going on with your records that are configured there. That would indicate, “Hey, go look at your nameservers. Do you have the A records configured correctly? Have they propagated?” Different things like that. So, again, you might not use this often, but when you do, it’s invaluable for troubleshooting.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So whenever there’s a new forum post about a new GrapheneOS version, there always seems to be some confusion as to why someone’s device has not received the new update yet. When they run a manual update check, it says their system is up to date, even though there should be a new version available. So today, I want to talk about how releases work and why you do not receive them as soon as they are announced.
If we check out the section about the releases on GrapheneOS.org, which I will link down below, we can see here in the last paragraph: releases are tested by the developers and are then pushed out via the Alpha channel. The release is then pushed out via the Beta channel shortly afterwards. Finally, the release is pushed out via the Stable channel after being tested by some of the users in the Beta channel. In some cases, problems are caught in the Beta channel testing, and a new release is made via the Beta channel to replace the aborted one.
So now let’s talk about what this actually means. First thing, I want to take a look at my device here. If we go into Settings, System, and we go to System Updates, and if we take a look at Release Channel under Settings, we can see here this corresponds to exactly what I just read: there’s the Stable, Beta, and Alpha. So when there’s a new forum post, like I showed earlier, that means that a new release was pushed to the Alpha channel, which is why, if you’re on the Stable channel, you don’t get it. If you’re on Beta, again, you won’t get it because it’s still in the Alpha channel. But then, as stated here, after the testing is done in Alpha and Beta, it then goes to Stable, and your phone now gets it.
So then, if we scroll down to the Devices section, we can see some more details on what I was talking about. I don’t think many people look at this often, but I think it’s useful to know where the information is, so if you need to do some troubleshooting or you need to find the answer for yourself. So if we take a look here at the Pixel 9 Fold, we can see again the three channels. We can see the version that’s in each channel, and then we just have some ways to download it over here. But back to the versionβso again, let’s say there was a new version, you’d first see it in Alpha, Beta, and Stable.
So speaking of versions, I just wanted to quickly cover how version numbers are created. So, as an example, if we go down to this version number, it’s the four-digit year followed by a two-digit month, then a two-digit day. Then, for the first release of that single day, it’ll be 00. We can see that on October 17th, 2024, there was another release done on that day, which is why it ends in 01. Under each individual release, you can also see what changes were made. So I like to read this whenever a new release comes out to see what changes I can expect. It’s helpful if there was a bug you were experiencing, and you can now see that it was fixed or something like that, or a new security feature.
So you might be asking yourself: why would you want to use the Beta or Alpha channel? Maybe you want to help out with testing, which I know the team could always use more people to help test. So if you switch to Beta or Alpha, it’d be helpful to go on the forum, and then, once these releases are posted, if you experience any issues, post them there. You can also join the Matrix rooms, where they have dedicated channels for that testing. Again, you can post there. It’s usually most needed when there’s a new major Android release version. So from Android 14 to Android 15, there’s always a lot of changes, always a lot of things that need to be tested.
So there’s a couple more things I want to mention about channels. Typically, with a product, either software or something in the physical world, you might say, “This is the Alpha release” or “the Beta release,” and typically, what that means is it’s not production-ready yet. That is not the case with these releases. So when a build makes it to the Alpha channel, if there’s no problems found, that same exact build goes to the Beta channel. And again, if there’s no issues found, that same exact build goes to the Stable channel. There’s no separate build that is built. Everything is technically production-ready, and that exact same build goes through all three steps. So if you are using the Beta channel, don’t think you’re using a Beta version of GrapheneOS. Yes, the build is in the Beta channel, but if there’s no issues found, again, that’ll get pushed to Stable, and it’ll be the exact same version that you’re using in Beta.
I know that was a lot of information, so if you ever need a break, you can check out my new podcast, which is called In the Shell. It’s stories of malware, hackers, and the people who shape tech. And if you want to find out where you can listen, you can head on over to intheshellpodcast.com.
So the last thing I want to mention is that it can be kind of a pain to have to come here and read the release announcements. It can be annoying to have to come check this web page. Thankfully, they offer an Atom feed. So if you use an RSS reader, you can subscribe to this URL in there, and you can easily track the feeds. If you’ve never used an RSS reader before, I talked about how I use one and the brief history of them in my latest email newsletter, which you can sign up for at sideofburritos.com.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So, without fail, every couple of weeks I either see an email, a forum post, or a comment on a YouTube video where someone says they want to try GrapheneOS but they’re afraid they’re going to brick their device. The general consensus is that with the web installer, it’s nearly impossible to brick your device. But instead of just saying that, I wanted to make a video showing that things can go terribly wrongβand you still will not brick your device.
Here we have a Pixel 7 running stock Android OS. This isn’t going to be an instructional video, so I’m going to fast-forward through a lot of parts. The first step to install GrapheneOS is to put the phone into Fastboot mode. So, let’s restart it. Just ignore the pop-up on the screenβI’m running macOS, and that’s part of the OS.
Step 1: Unlock the Bootloader
Even if you unplug your device right now, everything is still happening on the device. The actual unlocking of the bootloader doesn’t require the computer to stay connected. So, let’s unlock the bootloader. Again, these are things you should not be doingβIβm just showing you that they still work.
Once the bootloader is unlocked, it’s worth mentioning that all existing data on your device will be erased. This happens regardless of how the rest of the installation goes. Once you unlock the bootloader, all your data is gone. Now, letβs move on to the second step.
Step 2: Download the Release
Iβve already downloaded the release earlier, so it’s cached in my browser. Again, this step happens in the browser, not on the device yet. Now, weβre at the part where we flash the release to the device.
Letβs flash it. And just for demonstration, letβs unplug the device during this process. Why not? The device is restarting, the computer has lost connection with it, and weβre back to the Fastboot interface. Iβll plug the device back in, and our browser picks it up again, resuming the process. Now itβs writing some files to the device.
Letβs unplug it again. We see an error in the browserβno big deal. Letβs restart the phone and see where weβre at. Itβs just a warning that our bootloader is unlocked.
Testing the Worst-Case Scenario
While thatβs loading, let me quickly mention my new podcast, In the Shell. I launched it two months ago, and itβs about hackers, malware, and the people shaping tech. If youβd like to check it out, head over to InTheShellPodcast.com.
Now back to the phone. At this point, itβs not bootingβitβs stuck on the Google splash screen. This is likely the worst-case scenario youβll encounter, but itβs easily fixed with a forced reboot. Hold the power button and the volume-up button for about 15 seconds, and then hold the volume-down button to boot into Fastboot mode. Now weβre back in Fastboot mode. Letβs plug the phone back in and continue the installation.
Back on the screen, Iβll click Flash Release again. The phone is still connected, so itβs continuing the process. So far, our phone is not bricked.
What Happens if You Lose Internet?
Another concern people have is losing internet during installation. Let me turn off my laptopβs Wi-Fi. As we can see, the internet is gone, but the installation is still continuing. This is because the installation doesnβt require an active internet connection once youβve downloaded the factory image. Youβre fine to proceed without the internet.
Now, letβs unplug the device again. Thereβs an error, so letβs restart the device and see where weβre at. At this point, we have a different screen. It says, βYour device is corrupt. It canβt be trusted and may not work properly.β Again, this is another worst-case scenario.
To fix this, press the power button to continue past the bootloader warning. As we saw before, itβs stuck on the Google splash screen. Letβs do another forced rebootβpower button and volume-up buttonβand hold the volume-down button to go back into Fastboot mode. Here we are, back in Fastboot mode. Letβs plug in the USB cable again and click Flash Release. The phone is detected again, and the process starts over.
Refreshing the Page During Installation
Now letβs test what happens if you refresh the page during installation. Iβll refresh, and as expected, it seems like everything is messed up. But this could happen to you, so letβs fix it. Press Flash Release again. It doesnβt seem to find the phone, so letβs unplug it and plug it back in. That reset the connection, and now itβs continuing the process.
Finishing the Installation
This time, I let the flash complete. Letβs move to the next step: locking the bootloader. Thatβs done. The bootloader is locked, so letβs restart the device.
We now have the GrapheneOS welcome screen. The installation was successfulβeven after unplugging the USB cable, doing hard reboots, refreshing the web page, and turning off the internet. We were still able to install GrapheneOS without bricking the device.
Conclusion
As long as you can do some basic troubleshootingβlike unplugging and plugging back in the USB cable if the connection doesnβt work or doing a forced reboot with the power and volume-up buttonsβyouβll have no problem installing GrapheneOS using the web installer. You will not brick your device.
If you have any questions or comments, feel free to leave them below. See you next time!
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So the app we’re going to be talking about today is called App Verifier. It’s useful if you download APKs without an app store and install them on your device, or if you use something like Obtainium to obtain apps directly from repositories or different sources. App Verifier adds one more layer of verification to the APKs that you download.
This is the official repository for App Verifier. If we check the description here, we can see that App Verifier takes the app’s package name and the signing certificate’s hashes and compares them to the ones you provided or the ones in the internal database to verify that your apps are genuine.
While that description might be a little confusing, let’s walk through a demonstration of how to use it. The first step in order to use it is to install it. We can see here on the GitHub repository that the recommended way to download it is to get it on Apt if you’re on Graphene OS. If you don’t have Apt installed yet, you can swipe up, go to the app store, and install Apt from there.
Once you do install Apt, open the app, scroll down to App Verifier, and install it. Now, once that’s installed, we can go into the app. The first thing youβll see is the privacy policy; give it a read over and then accept it. It basically states that there’s no warranty and that itβs provided as is.
On the main screen, the first thing we have is an app list. This shows all the current apps you have installed under your user profile. In my case, I have Obtainium and Apt installed. We can see here that there are two green check marks next to the app. If you select the app, we can see that the Apt hash was verified using the internal database. You can select “Success” if you want to see details on how it was matched. This is a great way to verify the apps you currently have installed on your device.
The next option is to verify an APK file. If you have some APKs you downloaded, you can manually verify them there. The last option is settings, so feel free to give those a read over if you want.
The main way I think most people will use App Verifier is in conjunction with Obtainium. For this example, Iβm going to install LocalSend. Iβll paste the repository here and select the APK. Once itβs ready, Iβll select install. Itβs automatically shared with App Verifier, which is convenient.
We can see here that LocalSend was verified using the internal database. Success! You can then swipe back and go ahead and install your app as you normally would.
Another way you can use App Verifier is to manually verify APKs. For example, letβs say you want to download the Signal APK. Iβll download it from their site. Once itβs downloaded, we can go into the App Verifier app, select “Verify APK,” and find our download. When we select it again, you can see it was successfully verified using the internal database.
One more feature I want to show you is down here: you can verify from clipboard. In the case of Signal, they publish the hash for the APK on their site, which we can see here. Weβll just copy it, and if we go back to App Verifier and select “Verify from Clipboard,” paste it in there. We can see the verification status as success.
The reason that verifying from clipboard is useful is that not all apps are inside the internal database. For another example, letβs download the Standard Notes APK from their repository. Once that finishes, weβll go to App Verifier, select “Verify APK,” and choose the new APK we downloaded. We can see that the internal database status is not found.
This highlights the crux of App Verifier: if the certificate hash for an app is not in the internal database, then you need to go around and find it. Unfortunately, most developers donβt publish it anywhere, so you really do need to look for it and hope you can find it.
In the best-case scenario, using App Verifier as an example, we can see here in the README that the developer does post the certificate hash. Additionally, they also post it in a third-party location, which is great. We can see that it can be found in a Blue Sky post. If we open that, we have the matching certificate hash.
The reason having it in a third-party location is beneficial is that, letβs say someone compromises the GitHub account for this app and uploads a new APK; they would also need to update the certificate hash. If they upload a malicious one, anyone trying to verify it would use the incorrect hash. Posting it in a third-party location means that two different accounts need to be compromised, which is much less likely than just compromising one account.
Getting back to the main reason for discussing this: unfortunately, thereβs not much more you can do. You could ask the developer to publish it on the repository or on one of their social media accounts for verification. Another option is to download it from a trusted source. For example, I could download Standard Notes from Google Play in a separate user profile, install App Verifier, check the certificate hash here, and then compare it on my other user profile with the app downloaded from GitHub.
Honestly, thatβs a lot to do. Personally, I donβt do that; I just trust the APK I download from GitHub. Itβs not the best practice, but itβs not perfect.
If we check the contribution guide, we see that contributions of new apps to the internal verification info database wonβt be accepted at this time. Hopefully, that changes in the future, and maybe the developer builds some system for submissions or some way to verify better. But until then, if itβs not found in the internal database, you just need to hope the developer of App Verifier adds it.
With all that being said, I still think this is a great app and it has a lot of potential. So check it out and see if it fits into your workflow. If you have any other questions or comments, feel free to leave those down below, and I will see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
Android 15 has recently reached the stable release channel on GrapheneOS, so if youβre watching this video, you likely have it installed on your device. In this video, I want to cover a few visual changes I noticed along with a couple of new features. If youβve found something new, feel free to share it in the comments below!
The first change is the password authentication popup. When opening an incognito tab in Vanadium, you wonβt see it due to screen recording limitations, but the old popup was shorter and boxier, while the new one is taller with curved edges. Not a huge change, but personally, I preferred the shorter style. Now, letβs switch back to the regular tab.
Next up is a convenient product placement! My new podcast, In the Shell, launched a few months ago. Itβs all about hackers, malware, and the tech shaping our world. Season 1 dives into the infamous worms that have flooded the internet over the past decades. You can check it out at intheshellpodcast.com.
Another visual change is in the volume slider. Hitting the three dots at the bottom reveals more rounded visuals, giving your phone a more βcurvaceousβ look. Functionally, not much has changed; you can still select the audio output device, but everything else remains the same.
Now, letβs talk about tiles at the top. If you go to Bluetooth, thereβs a new option to automatically turn it on tomorrow. This feature might be geared toward the βFind My Deviceβ functionality. Itβs handy if you want to disable Bluetooth today but donβt want to forget to turn it on tomorrow. I think this mirrors a similar feature in iOS, though I personally donβt use it.
A feature I recently discovered is split-screen functionality on phones, which also works on Android 14 and Android 15. To use it, open the first app, swipe up, tap the app icon, and choose βSplit screen.β Then, select the second appβletβs use Vanadiumβand adjust the screen space each app takes. In Android 15, if you swipe up and tap both icons, youβll now see a βSave app pairβ option, letting you create a shortcut to open both apps together. Iβve used split-screen for copying passwords from my password manager to a browser.
Next is app archiving. If you long-press on an app and go to βApp Info,β thereβs an archive option. If you donβt have the Play Store in the user profile, the option is grayed out. This feature replaces the app APK with a smaller archived version while preserving user data, freeing up space without deleting your data. Personally, I donβt see a need for it, as my storage usage is low.
Lastly, thereβs the Private Space feature, which many are excited about. However, itβs only available in the owner profile. Hereβs a quick overviewβIβll do a full video on it soon. To set it up, go to Settings > Security and Privacy > Private Space, enter your PIN, and set up a separate lock if you like. Private Space creates an isolated workspace for apps and data with its own VPN settings and encryption. This can be useful if you want separate environments, like using Orbot in the owner profile and Mullvad in Private Space. I recommend using Private Space over work profiles for better integration and isolation.
That wraps up this overview. Iβll be back with a more in-depth look at Private Space soon, but if you have questions or comments, feel free to leave them below. Thanks for watching!
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
We you ever sitting there, wondering: how do I get these files from my phone to my computer, and vice versa? You could use a USB drive or cable to plug it directly into your computer, or you could use some sketchy third-party website to temporarily upload the fileβbut thatβs all pretty inconvenient. What if you want to transfer something between an iPhone and an Android phone or between two Android devices? What do you do then?
If you have an iPhone and the other person has an iPhone, you can use something like AirDrop to transfer files. But if you want to transfer files to a computer, you need to make sure it’s a Mac; otherwise, AirDrop doesn’t work. Thatβs pretty inconvenient too. And you know what? Sometimes, there are just some files you donβt want to put in the cloud. Thatβs where LocalSend comes in.
LocalSend is an open-source, cross-platform local network transfer app. No internet connection is required, except to download the app. For this demo, Iβll be using my desktop computer along with my Android device running GrapheneOS.
Step 1: Download and Install On the desktop computer, head over to LocalSend.org, click download, and select the appropriate installer for your platform. Iβm on macOS, so I downloaded the DMG. Once installed, you can open the app. The interface is super cleanβI’m a big fan of nice interfaces!
On the other device, which in my case is my Android phone, go to LocalSend.org again. For Android, you can get it from Google Play, F-Droid, or download the APK directly. Use whatever method you prefer to install apps. For iOS, itβs on the App Store. LocalSend is available on Linux, Windows, macOS, and Androidβpretty much all platforms.
Step 2: Setup and Transfer Once installed, open LocalSend on both devices. On my phone, the default screen shows a friendly, randomly generated device name. In my case, my phone is named “Patient Coconut,” and my desktop is “Fantastic Tomato.” It’s fun how they name the devices like that.
For transferring files, on my Android device, I’m going to be receiving files, so I’m on the “Receive” tab. From the desktop, I’m going to be sending files. I go to the “Send” tab, where “Patient Coconut” appears, matching my Android device.
I have some test files here. The first one is an image, which is the cover art for my new podcast. If you want to check that out, head over to InTheHellPodcast.com. Dragging the file to the “Send” section, it shows a preview: one image, file size 2.5 MB. I select the receiving device (Patient Coconut), and now on my phone, it shows that “Fantastic Tomato” wants to send a file. I can either accept or decline. I accept, and boomβthe file is transferred!
If we check the gallery, we can see the file is there. Itβs really that simple.
Other Features LocalSend also allows you to easily send folders. If youβve ever used Signal to send files to yourself, youβll know you canβt send folders unless you zip them. With LocalSend, it’s as simple as dragging the folder. I tested this with a folder containing four images. Just drag, select the receiving device, and accept. The transfer is done, and when I check my files, thereβs the folder with all four images inside.
Another cool feature is the ability to send text to yourself. There have been times when I needed to send a URL to my phone while setting up a new device. Instead of emailing it to myself, you can just copy the text, go to the “Text” option in LocalSend, paste it, select the device, and send it. Youβll get a notification saying “Fantastic Tomato sent you a link,” and you can copy or open it. Itβs as easy as that.
For Android users, thereβs also an app option where you can send APKs of your installed apps. This is super useful if you have another Android device without internet access and want to transfer apps.
Comparison to AirDrop One feature I missed from my iPhone days was the ability to send multiple photos to someone using AirDrop. With LocalSend, itβs very similar. You can select photos, select the receiving device, and send them over. Itβs seamless and well-integrated into the system.
One Caveat The main caveat with LocalSend is that both devices need to be on the same Wi-Fi network to find each other and transfer files. If thereβs no Wi-Fi around, a workaround is to create a hotspot on your device and let the other person connect to it. Once connected, you can launch LocalSend and start transferring files. Itβs not as convenient as AirDrop, which uses Bluetooth and Wi-Fi, but it works.
How It Works If you’re curious about the technical side of LocalSend, the receiving device sets up a web server, and the sending device sends files to it. The files are transferred over HTTPS, so theyβre encrypted during transit. Itβs a really elegant and simple solution, especially when dealing with different platforms and devices.
If you have any questions or comments, feel free to leave them down below. I’ll see you next time!
]]>Response from SMSPool on what they do with used phone numbers
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
Before we begin, I want to make a quick disclaimer. If you’re just starting out using GrapheneOS, I highly recommend not using the setup I’m about to discuss in this video. This setup will create friction, and friction is the enemy of adapting to something new, especially if you’re hesitant to begin with. When you install GrapheneOS, just install the Play Store, sign in, download apps as you normally would, and get used to things. You can always switch to a different setup later. For everyone else, here’s how I install apps on my Google Pixel running GrapheneOS.
So, this idea was suggested to me around two years ago, but I finally set it up about one year ago. This isnβt something that was just shared with me recently and now I’m sharing itβIβve tested it, and itβs been working well for me. This also wonβt be a step-by-step guide. Iβll demonstrate installing three different apps from three different sources and give you details of my setup. When I upgrade my device in the future (still TBD), I plan to make a step-by-step video.
Before we begin, I want to mention that I just published the second episode of my podcast, which is called In the Hell. If you want to find out how you can listen to it, head over to inthehellpodcast.com, which Iβll link below. It’s also worth noting that it’s hosted on Yellowball, the no-BS podcast hosting platform I recently launched, in case youβre looking to start your own podcast.
When you first install GrapheneOS, you have one user profile, the owner profile, which is there by default, and you cannot delete it. From there, you can create additional user profiles depending on how you want to separate your apps. In my setup, all apps are installed from the owner profile, and I use the “Install Available Apps” feature to push those apps to my daily user profile. I like this setup because it lets me install apps from the Google Play Store without actually having the Play Store installed on my daily user profile. Itβs kind of like having a command center for app installations.
The recording on the screen right now is my owner profile. The first thing I did when I set this up was install Orbot, which is a free proxy that lets you send all your device traffic over the Tor network. That means that all of our traffic when accessing the Play Store will go over the Tor network, along with any downloads of system updates from GrapheneOS, since those are all done from the owner profile. You can install Orbot by downloading the APK from GitHub, which Iβll also link down below.
Once we open Orbot, we can click “Start VPN” and give it a minute to connect. Now we have a full-device VPN, which means all of our owner profile traffic is going over the Tor network. Itβs important to note that VPNs are profile-specific, so while our owner profile traffic is using Orbot, any secondary user profiles (which weβll discuss later) will not use Orbot by defaultβitβs only for the profile that it’s installed on.
You might notice where it says “Change Exit.” I currently have it set to the United States, and the reason for that is that sometimes when you go into Google Play, it might say “App not available” if the exit node is in a different country. This is common with banking apps or social media apps. If you run into that issue, you can change the exit node to match your country and see if you can access the app.
One other quick tip about Orbot: if you switch networks (for example, from Wi-Fi to cellular) or the Wi-Fi disconnects, Orbot might say itβs connected, but itβs really not. Youβll notice that because your browser wonβt be able to load anything. What I found helpful is to long-press on the Orbot app, select “App Info,” force stop it, then clear the cache (but donβt clear the storage). After that, restart Orbot, click “Start VPN,” and nine times out of ten, it fixes the issue.
Now, letβs talk about the first app store I use. The first store I search for apps is the default GrapheneOS app store. In this case, I installed Accrescent from here, which is actually the second app store I use. If an app isnβt available in the first store, I move on to the second. The GrapheneOS app store mostly has system apps, but Accrescent is available there, so I installed it from there.
The second app store I use is Accrescent. There arenβt a ton of apps here, but itβs actively developed, and theyβre constantly adding new apps and working with developers to get more. I plan to make a video just about Accrescent in the future because theyβre doing great work, especially from a security perspective. For this demonstration, Iβll be installing Xf Eraser. I just click “Install,” and itβs done.
The third app store I use is Obtainium. If youβve never used it before, it can be confusing, but I have a video dedicated to it, which Iβll link below. I use Obtainium for all my open-source apps or any apps that publish APKs directly on their site or on GitHub. For this example, Iβll install NewPipe. Iβll copy the GitHub link, add the app to Obtainium, and let it download. Then Iβll install it.
With this owner profile setup, I always make sure to uncheck “Allow Network Permission” when installing apps because I donβt use these apps in the owner profile. If you forget to uncheck it, you can always change it later. Now we can see that NewPipe is installed.
So far, weβve seen the GrapheneOS app store, Accrescent, and Obtainium. The last store I use is the Google Play Store, which I installed using the GrapheneOS app store. Youβll notice that thereβs no “Install” button for Google Play Services because I already have it installed. The issue with the Play Store is that you need an account to access it, which sucks. Unlike Aurora Store, which lets you use anonymous accounts, Iβm not a fan of shared anonymous accounts, so I prefer this setup.
Creating an anonymous Google account without getting it blocked or locked is somewhat difficult but not impossible. If you try to create it over a VPN or Tor, youβll likely run into issues. What I do is drive to a parking lot with free Wi-Fiβlike at a grocery store or coffee shopβconnect with my laptop, and create the account using a fake name generator for the required information.
The tricky part is when they ask for a phone number for SMS verification. You donβt want to use your real number here because it would ruin the anonymity. Instead, you can temporarily rent a phone number just for receiving the SMS code. There are free services, but I wouldnβt recommend them because theyβre public and often blocked. Youβll have to pay, but itβs usually 50 cents to a dollar. Iβll link the site I use in the blog post for this video, but I wonβt mention it here on YouTube. Once you receive the SMS code, you can validate your account.
Iβve done this for about ten different Google accounts without any issues. The key is to practice compartmentalizationβdonβt use this account for anything else. Just use it for the Play Store. If you get a new device, create a new account rather than using the same one. It sounds like a hassle, but itβs how you keep things separate and private. And since Orbot is running, all of your Play Store traffic is going over the Tor network, which helps maintain your anonymity.
Some people might critique using a shared phone number for account validation. While thereβs a small risk someone else could gain control of that number, from what I can tell, itβs only used for initial validation, and Google doesnβt tie it to your account. If youβre concerned, you could use a prepaid SIM instead, but personally, I think the risk is low.
At this point, you can now sign into the Play Store with an anonymous Google account and start installing apps. For this demo, Iβll install WhatsApp. You might notice slower downloads when using Tor, but thatβs normal. After installation, Iβll uncheck “Allow Network Permission” like I did with NewPipe.
Now, to avoid accidentally using the apps in the owner profile, Iβll disable them. Long-press on the app, go to “App Info,” and click “Disable.” Iβll do this for NewPipe, WhatsApp, and Xf Eraser.
The next step is to use the “Install Available Apps” feature to push these apps to my secondary user profile. In the demo, I created a profile called “YouTube Demo,” but you can call it whatever you like. This is the profile youβll use daily instead of the owner profile. Once you select the secondary user profile, you can go to “Install Available Apps,” check the apps you want to install, and theyβll be available in the secondary user.
To switch profiles, swipe down from the top of the screen, tap the user icon, and select the profile. Screen recordings donβt work across profiles, so Iβll be back in a moment.
Now weβre in the secondary user profile. If I swipe up, youβll see the apps we installedβXf Eraser, NewPipe, and WhatsAppβall from different sources.
So this is how I install apps on my device running GrapheneOS. If you have apps that require Play Store Services, you can install them in the secondary profile. In my setup, I only have Play Store Services running in a specific profile for calls, not in my daily profile.
The benefit of separating profiles like this is that you can end a session for a profile where Play Store Services are running. This essentially puts that profile to rest, so Play Store Services are no longer running in the background. You canβt do this with the owner profile unless you power off the device. This method allows you to shut down Play Store Services without turning off your device.
One more thing to note: thereβs only one instance of an app installed on the device at a time, so when you update an app in the owner profile, itβs updated across all profiles. You donβt need to worry about updating it in each profile.
After recording this, I realized itβs a lot of information, and it might seem overwhelming. But once you set it up, itβs pretty much “set it and forget it.” When you need to install a new app, install it in the owner profile, disable it, use “Install Available Apps” for the secondary user, and youβre good to go.
If you have any questions or comments, feel free to leave them down below, and Iβll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So after a year, I figured it was finally time to put out an update on my Pixel Tablet experience running GrapheneOS. Spoiler alert: my original video had some high ambitions of replacing my laptop and taking this with me when I travel, along with a keyboard and things like that. None of that happenedβit didn’t work out. But if you’re curious as to why, keep watching. If all you wanted was that quick answer, there you go, and I’ll see you next time.
Before I get into the apps that I’m using and things like that, I first want to talk about the physical aspects of the tablet that I really like. To begin, let’s start with the case. This is the official case from Google, and if you end up buying the tablet after watching this video, or have bought the tablet, I highly suggest you buy this case. It’s probably one of the best-designed cases I’ve ever usedβnot that I’ve used many cases, but to start off, it’s a nice rubbery, grippy texture that helps with holding onto it. Besides that, you have this circle thing on the backβor oval, I should sayβand that’s great for a kickstand, holding it up in the landscape position. It also works in the portrait position, so it can lean back like that. When you’re just kind of walking around or laying on your couch, it works great for holding it just like this.
You might be wondering why it’s that shape. You see those four pins on the bottom? Those correspond to the dock. When this goes on the dock, the handholdβor whatever that metal thing isβhelps align the dock so that it locks into those pins, giving you a good connection. It’s all magnetic, so the dock just snaps on. This is the only way I charge itβI’ve never actually plugged a USB cable into this, except for during installation. So, the caseβI highly recommend it.
Now, back to the dock. The dock is included in the box. I’m not going to say that the dock is free because, of course, I’m sure that’s baked into the price somewhere, but the dock has exceeded my expectations, mostly from an audio standpoint. When you set the tablet on the dock, this then turns into the main speaker; the internal speakers on the tablet are disabled, and the audio comes out of this. For listening to music or podcasts, things like that, you’re not getting room-filling booming audio, but it is pretty impressive for the form factor. I like using this when I’m listening to podcasts or audiobooks on the tablet. It just works really great for that.
Speaking of podcasts, I wanted to let you know that I just published the first episode of my podcast, which is called In the Shell. You can check that out at intheshellpodcast.com to find out where you can listen to it, and I will also leave a link down below in the description if you want to check it out.
So now, let’s get back to the reason why you clicked on this video. One more thing to mention about the physical appearance: I don’t use a screen protector on the tablet. They do make them for it; I just never found a need for one. It’s not like a cell phone where I’m carrying it around, constantly taking it out of my pocketβthis wouldn’t fit in my pocket. So, I didn’t really see a need to have a screen protector. So far, after a year, it looks goodβno chips, cracks, or scrapes. Hope I didn’t jinx myself, but so far, so good.
On the actual tablet, I have two user profiles set up. I have my main owner/admin user profile that you can see here, and I have my daily “Josh” user profile. On my main owner profile, I have the Google Play Store installed along with Obum. On that profile, I do all the installation of apps, and then I use the “install available apps” feature from the main owner profile to push the apps to my daily profile. It was suggested to me a while ago to test out that method, and I’ve been using it ever since on my phone and tablet. I’m not going to cover it in this video, but I will make a dedicated video specifically for that topic because I think it’s a really useful way to configure your GrapheneOS device.
As I mentioned, I have two user profiles set up. We’re currently in my daily profile that I use, named “Josh.” You can see that in the top right-hand corner up there. On the main home screen, I have two Progressive Web Apps (PWAs) installed: one is for Miniflux, a self-hosted RSS reader that I use, and the other is Wallabag, which is kind of a bookmarking toolβanother self-hosted app that I use.
So let’s now swipe up and get to the app drawer. I’m not going to explain the default apps installed, like the camera, gallery, etc. If you have GrapheneOS, you’re already familiar with those.
To start off, I have AntennaPod, which I use for listening to podcasts. Like I said, that goes really well with the dockβyou get really good audio quality, and it works well for listening to those. The next app is Audiobookshelf, a self-hosted app I use to listen to my audiobooks. Then there’s Bitwarden, a password manager. I also have a calendar app and EteSync, which is a contacts, calendar, and task sync appβanother self-hosted app that I use. They also offer a cloud service, so if you’re looking for an encrypted way to store your calendar, contacts, and tasks, I would suggest checking out EteSync. You don’t have to self-host it; you can just sign up and use their service.
Following that, I have Jellyfin. I run a Jellyfin server at my house for my movies and TV shows that I want to watch. The Jellyfin app lets me access and watch those on the tablet, which, with the 11-inch screen, works perfectlyβmuch nicer than trying to watch on my phone. Material Files is a third-party file explorer I use to connect to some network shares I have in my house. I don’t have it installed on my phone because I don’t access my network shares on my phone, but on the tablet with a larger screen, it works great for that.
Mullvad is my VPN of choiceβit’s running on here all the time. NewPipe is the next app, which is a third-party client for YouTube that helps you avoid the ads, which is nice. Notify is an app that provides push notifications to my device when it receives a webhook notification from the uptime services that monitor my site and different services. It works without Google Play Services, which is why I have it installed on here, since I don’t have Google Play installed on this user profile.
ProtonMail is my email provider. I have their paid plan, so I use it for my sideofburritos.com domain. If you’re looking for a decent email provider that’s privacy- and security-focused, I would recommend them. The next app is Standard Notes, which I use for all my note-taking. I have a couple of files stored in there, but primarily just text files. I self-host the Standard Notes server at my house, so it syncs locally to a Raspberry Pi where I have that running. They do have a cloud offering, so if you’re looking for an encrypted notes service, I would suggest checking them out.
Next is Tasks, which syncs with EteSync, as I mentioned earlier, for contacts, calendar, and tasks. Tutanota is another privacy-focused email provider that supports end-to-end encryption, just like Proton does, which means they have no access to your emails or the content of them. I’ve always wanted to test them out, so when I set up the email for (https://yellowball.fm), the podcast hosting provider that I recently launched, I decided to go with them. So far, so goodβI like their product and interface. As a company, I kind of prefer them over Proton. Proton’s kind of turning into a commodity; it seems like they’re just launching more products and everyoneβs using them. While I appreciate that because it means they’re more accessible to the masses, at the same time, it’s kind of nice to support companies that are more niche in privacy and security, and Tutanota seems to be that.
The last app is VLC, which I use to play any files that the default gallery app can’t play. VLC basically plays any file you throw at itβsometimes I think it’ll even play a text file. It’s just one of those solid apps to have.
As I mentioned in the intro, I had high ambitions for thisβplugging it into an external monitor, plugging it into a keyboard, possibly using it as my full-time device. But it’s just not going to replace a laptop, especially for someone like me doing programming, editing, recording videos, and things like that. The interface just isn’t meantβat least at this pointβfor a mouse and keyboard to be as productive, or even close to it, as a laptop, at least from my perspective. Again, your results may vary.
But that being said, would I recommend this to someone? If you want to use it like me, where 99% of the time I use it as an entertainment deviceβwatching YouTube videos, watching Jellyfin, checking my email, or browsing the webβthen absolutely, I think this is a great device to purchase. But other than that, I don’t really use it for much else.
So I hope I didn’t disappoint you too much, and if you have any questions about the tablet, feel free to leave those down below, and I will see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
I finally found my battery, so I can start recording videos again. The feature I want to talk about today is the duress PIN/password feature that GrapheneOS released a few months ago. First, we’ll start by looking at the documentation, and then I’ll show you how to set it up on a device and what the actual wipe process looks like once you enter the duress PIN/password.
Looking at the official documentation, which is always the best place to go first, I will link that down below. GrapheneOS provides users with the ability to set a duress PIN/password that will irreversibly wipe the device along with any installed eSIMs. Once entered, anywhere the device credentials are requested, such as the lock screen or any other prompt that the OS shows you asking for your PIN or password, the wipe does not require a reboot and cannot be interrupted. So once it’s entered, all data on your device is completely inaccessible, and you will never have access to it again. Take that as a warningβbe careful with this. Once you set it, do not enter it just to test for any reason whatsoever, because all your data will be gone.
Both a duress PIN and password are needed to account for the different unlock methods that user profiles may use. You might have one user profile with a PIN and another with a password, which is why you need to set both. It’s important to note that if your duress PIN is the same as your actual unlock PIN, the actual unlock PIN will take precedence. So, let’s say your duress PIN is 1234 and your unlock PIN is also 1234βonce you enter 1234 into your device, it will be unlocked, and you will not wipe the device.
One more thing I want to mention before I get into the live demo: make sure you check into any local laws or regulations regarding this feature. If you’re at the airport and they ask you for your PIN, and instead, you enter this and your device is wiped, who knows what could happen. Destruction of evidence could be one of many legal implications. So, make sure you understand the ramifications of using this feature, wherever you are in the world, before actually using it.
With that out of the way, let’s check out what this actually looks like. Here, I have a Google Pixel with GrapheneOS installed. The only thing I’ve done is set a PIN code, which is 12345. In order to set a duress PIN/password according to the documentation, we go into Settings, scroll down to Security, and then we go to Duress Password. We need to enter our device PIN to authenticate that it’s us. Once you finish reading the text on the page, you can select the duress PIN. I’m going to set the PIN to 1111 and the password to qqqq. Once we select “Add,” again, you’ll see a warning about what will happen if you enter this. Select “Proceed,” and now on this screen, you can either update your duress PIN or password or delete it.
So now, let’s see what the actual wipe looks like. We’re all pretty familiar with the lock screenβif you enter it there, the phone will be erased. To show you a little more non-standard scenario, if we go into Settings and back to Security, in order to set a fingerprint, you have to enter your device PIN. We’re going to select the fingerprint unlock, and now this is an example of the OS prompting us for our PIN. Instead of entering my actual PIN, I’m going to enter my duress PIN. You’ll see it says “Wrong PIN,” the device powers off, and the irreversible wipe has occurred along with wiping all installed eSIMs. At this point, you can power the device back on. Just give it a minute to power up. This is the screen you’ll see after the wipe occurs. You can go down to the factory reset. It’s important to note that this feature does not brick the device in any way; it just makes the data completely inaccessible. So, we select the option for factory reset, confirm that, and now we have a fresh installation of GrapheneOS.
Whether or not this feature is applicable to you and your threat model is a personal decision and something you need to decide. I would caution against setting it to something simple like 1234. If someone has your device and, as a joke, they enter that PIN, now your device is wiped, and that would not be good. I do want to point out one other site that I think someone posted on the GrapheneOS forum. Someone did some duress password QA testingβthey just went through a bunch of different scenarios to test it out. I thought it was something cool to check out, so I’ll link that down below. One other use I saw someone mention for this feature is: you take a piece of paper, write your duress PIN code on it, and put it in your phone case. If someone finds your phone and they think you just left your PIN code in there because you’re forgetful, they’ll enter it, and your device is wiped. That’s one option I likeβthat’s something to consider.
So, for the last year, I wanted to start a podcast, and when I started looking at where I could host it, I couldn’t really find an option that had everything I was looking for from a privacy perspective. So instead, I decided to build that, and it’s called Yellowball. You can check it out at yellowball.fm. I would appreciate it if you could sign up and test it out. Let me know if you find any bugsβall you need to sign up is a username and a password. I know many of you are not looking to start a podcast, but if you’re like me, then in your friends and family, you’re likely the go-to person when someone has a tech question. So, if someone comes to you and asks about starting a podcast, if you could suggest they check out Yellowball, I would really appreciate it. Keep an eye out because in the next one to two weeks, I’ll be publishing the first episode of my podcast, which is going to be called In the Shell. It’s going to feature different stories from tech, different events that have happened in the past, and things I find interesting. So, if you’re watching this video a week or two after it’s been published, check down belowβI’ll link it in the description. If you have any questions or comments, feel free to leave those down below, and I’ll see you next time.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
In today’s video, I’m going to cover step by step how to install Graphene OS on the newly released Google Pixel tablet. I’m going to be using the web installer, which makes it nearly impossible to break your device. There are some hiccups you might run into during the installation, and I’ll cover those at the relevant points in the video.
So, to begin the installation, we’re going to head on over to grapheneos.org. Once you get there, select “Install Graphene OS.” Like I said, I’ll be using the web installer, so go ahead and click the “Web USB-based installer.”
Once we get here, go ahead and read through the prerequisites. You must be using a supported OS, which they do list here. I’ll be using macOS for the installation today. It’s also worth noting that if you have an existing Graphene OS device, you can use that for the installation, along with another Android device running stock Pixel OS or another certified Android variant. Make sure your operating system is up to date before proceeding, and then lastly, you must make sure you’re using a supported browser. In this video, I’ll be using Brave, but make sure that you are using one of the browsers listed above.
There are a couple of other notes below that I want to mention. If you are using Linux, avoid flat pack and snap versions of the browser as they’re known to cause issues during the installation process. Do not use incognito mode or other private browsing modes. The reasons why are listed here. There’s also an important note here; I don’t really think this applies to the tablet, but to make sure that the device can be unlocked to install Graphene OS, avoid carrier variants of the devices. So with the phones, they’ll have a Sprint or Verizon version, and those will usually have issues and you can’t unlock them. So if you do buy a device, make sure it’s OEM unlockable. I also suggest reading the rest of the information here, but I’m not going to read that to you.
The first step in the process is to enable OEM unlocking. One thing I want to mention is always go to the source for documentation and guides. Be hesitant to follow some random YouTuber or blog post that claims they have their own method or knows the process better. That’s why I’m following the official guide in this video. You’ll always get the most up-to-date instructions and information.
So, I just took this tablet out of the box and turned it on, which means we’re going to have to walk through the initial setup before we can actually enable OEM unlocking. If you’ve already gone through the setup on your device, feel free to skip this part in the video.
So, I’m going to select “Get started.” I’m going to set up offline, continue. I’m going to leave that set to the default. I’m going to uncheck these options, accept the limited warranty. Next, you should always set a secure PIN on your device, but since I’m going to be erasing the OS in five minutes, I’m just going to set “12345” for mine. I’m going to skip fingerprint unlock because we’re erasing the OS, so select “No thanks.” Swipe navigation, skip. That’s just a guide on how to use it, so if you need to follow that, otherwise skip it. We’ll swipe up to go home.
So, we are now at the home screen. Let’s go back to the instructions. Enable the developer options menu by going to Settings > About phone and pressing the “Build number” menu entry until developer mode is enabled. So, to do that, we’re going to swipe up, we’re going to scroll down and go to Settings, scroll down again, go to About tablet. Scroll down to the bottom, and you’ll see this labeled “Build number.” That’s what you want to tap until you see “Developer options” show up. You’re going to have to enter your PIN code to enable this. And then you’ll see the pop-up that says, “You are now a developer” on the bottom.
So, the next step is to go to Settings > System > Developer options and toggle the OEM unlock settings. So, we’ll go to System, we can see Developer options, select that, scroll down to OEM unlocking, which we can see is grayed out here. So, I did purchase this device brand new from Google, and it is unlocked. But, in order to enable OEM unlocking, you need to connect the device to the internet for the first time. If you bought your device used and someone has previously enabled OEM unlocking, you don’t need to worry about this step. But if you did buy this brand new, like me, you’re going to have to connect to the internet for this to be available. So, go ahead and connect to Wi-Fi. So, you can scroll up, tap “Network and internet,” select “Internet,” to your Wi-Fi network.
So, once your device is successfully connected to the internet, let’s go back to the Developer options, System > Developer options, and we can now see OEM unlocking is no longer grayed out, and we can now enable it. So, we’ll go ahead and tap the toggle. You’ll have to enter your PIN code again. You’ll see a pop-up for “Allow OEM unlocking,” select “Enable,” and OEM unlocking is now enabled.
So now, back to the instructions. The next step is flashing is non-root (this is for Linux, so if you’re on Linux, follow these instructions; if you’re not, skip ahead). The next step is booting into the bootloader interface. You need to boot your phone into the bootloader interface. To do this, you need to hold the volume down button while the phone boots (or, in this case, a tablet). It’s also worth mentioning that I’m making this video about 12 hours after the initial release of Graphene OS for the Pixel tablet, so some things on some wording may change in the future, but the overall general process will be the same.
So, to boot into the bootloader interface, if you’ve never done this before, it can take you a few tries. But what you need to do is swipe down, swipe down again, tap the power icon in the bottom right-hand corner, and then select “Restart.” And now, immediately hold the volume down, which is on the left side of the device on the bottom, then keep holding that. And if you are successful in booting into the bootloader interface, you’ll reach a screen that looks like this. This is going to be a little bit difficult for the camera since this is so tiny (that’s what she said). So here, you’ll see this output, it’ll have some information about your device, and also say “Device state is locked,” we’ll be changing that shortly. And for now, I’m going to set this down, and we’ll proceed onto the next step.
So, the next step is connecting the phone, or in this case, our tablet. Again, the Pixel tablet was just released, so they haven’t updated the wording yet, but this is referring to your tablet. So in the note here, if you are on Windows, you need to install a driver for Fastboot if you don’t already have it. No driver is needed on other operating systems. There’s a couple of ways you can install the Fastboot driver on Windows. The first and easiest way, you can obtain the driver from Windows update, which will detect it as an optional update when the device is booted into the bootloader interface, which is what we see on the screen now and connected to the computer. So that’s the easiest way. So if you are on Windows, just follow the instructions here. The second way is you can manually install it with Device Manager. So if you feel up to that, you can also go ahead and do that, but I would recommend the first method as that’s easier and more straightforward.
At this point, we can now connect our tablet to our computer. The typical recommendation is to use the USB cable that came with the device. The tablet does not come with one, so you’re going to need to use one that you have lying around or purchase one. Your best option will be to use the stock cable that came with a Pixel phone if you purchased one in the past, or you can just use whatever cable you have lying around that you know is in good working condition. That’s what I’m using. I just have a third-party cable here. As I mentioned in the beginning, there are a few things that could go wrong with the installation, and the USB cable is a big one that a lot of people have issues with. If you have any strange behavior during the installation, it’s likely due to a faulty USB cable. It might work for powering a device, but data and power use different pins on a USB cable, so it’s possible that the data pins are damaged, and it’s not working so good. First troubleshooting step is to try a different cable, purchase a new one, and again, use that if you have any strange issues during the installation process.
So I’m going to go ahead and connect this to my tablet on the bottom. There’s a USB-C port, plug in the cable there. So once you plug it in, we’re going to move on to the next step, which is “Unlock Bootloader.” So, one warning before unlocking the bootloader. This step will completely erase the device, so if you have any photos you took or maybe you have some contacts you saved, make sure you save those somewhere else first before moving on to this step. Again, this will completely erase the device and anything on there. So, we’re going to select “Unlock Bootloader.” We can see up here, “Pixel tablet” shows up on the screen, select that, press “Connect.” We’re going to see our screen change. We have a warning here, “If you unlock the bootloader, you will be able to install custom operating system software on this phone.” That’s why we’re here. So in order to do this, we can see up at the top right, it says the current option is “Do not unlock the bootloader.” We’re going to press either volume up or down to change the selection. So when I press that, it now says “Unlock the bootloader,” and then to select that, we need to press the power button. So I’m going to press the power button. Now that it says “Unlock the bootloader,” the screen goes blank for a minute, and as I mentioned earlier, down here, we had “Device state,” and it was green, and it said “Locked.” At this point, since we unlocked the bootloader, our device is now unlocked, and it’s red. You will also see the output on the screen that says “Bootloader unlocked.”
So the next step is obtaining factory images. In order to do that, press “Download release.” So depending on your internet speed, this can take a few minutes, but at this point, it’s just downloading the factory image. It’s not actually flashing it to our device yet. And while that’s downloading, I want to mention that if you get any value from Graphene OS or after you install it, you really like it and use it on a regular basis, consider donating to the project. And like I said earlier, they had this tablet release initial release out within 12 hours of me actually receiving the device in the mail, so they do incredible work. They’re a great resource for the privacy and security community. So any monetary contribution you can offer, I’m sure the project would appreciate.
So once the download has finished, you’ll see this has changed to “Downloaded,” doesn’t say “Download” anymore. So the next step is flashing factory images. The initial install will be performed by flashing the factory images. This will replace the existing OS installation and wipe all the existing data. I do suggest you give this paragraph a read before clicking the button above. The most important part down here is avoid interacting with the device until the flashing script is finished and the device is back at the bootloader interface. So once you’re ready, select “Flash release.” You’re going to see your screen flash and change. So just give it a few minutes for this process to complete.
So once the flashing has completed, the text on the screen will change to “Flashed,” and we can now proceed onto the next step, which is “Locking the bootloader.” Locking the bootloader is important as it enables full verified boot. It also prevents using fastboot to flash, format, or erase partitions. There’s also some other interesting information here, so I suggest you give that a read, but similar to how we unlocked the bootloader, in order to lock it, we’re going to select “Lock bootloader” in the corner. We now see “Do not unlock the bootloader.” We’re going to press the volume rocker either up or down, and it now has changed to “Lock the bootloader,” and then to select that option, we’re going to press the power button.
So I’m going to press the power button. Give it a second. And we can confirm the bootloader is locked as “Device state” is now green and “Locked.” So at this point, we are ready to boot up the OS. There’s a couple more steps we need to complete underneath the “Post-installation.” You’ve now successfully installed Graphene OS and can boot it. Nice job! Pressing the power button with the default start option selected in the bootloader interface will boot the OS. We can see the default option right now is “Start,” so select the power button, and our device will now start up.
So, this is the first screen you’re going to see. I’m going to press the power button quick to pause the display or to pause the boot process. So, this is normal to see if you have a different operating system other than stock Android OS installed on your device. We can see here, “Your device is loading a different operating system.” And on these post-installation instructions, there’s one step you can do here, which is “Verified Boot Key Hash.” So, we pause the screen by pressing the power button, and we can now see the hash listed out down there below. And what you want to do is look at that hash that’s listed next to “ID” and make sure that matches the, in this case, Pixel tablet. I’m going to read that quick, and it does match. So it’s just one other way to verify the integrity of the installation we just performed. If that matches, we can proceed. You don’t need to do this every time; this is just after the initial installation. I think it’s good practice. So once you’ve verified that, we can now press the power button to resume. So I’m going to select that. The next screen you’re going to see is the Google splash screen. That’s normal. Don’t be worried. And then we will see the Graphene OS screen. I’m going to let this complete the first boot, but we are now successfully booting Graphene OS. Once that finishes, we’re going to walk through the initial setup. I’m going to press “Start” next.
Change to your time zone.
Enable Wi-Fi if you want. I’m going to skip that for now.
I’m going to uncheck location services.
I’m going to skip the fingerprint setup.
I’m going to set up a PIN code, though. Don’t make your PIN code “12345.” I’m going to be wiping this device shortly.
Once you confirm that, I’m going to skip restore apps and data, and then we can press “Start.”
So I’m pretty excited. This is the first time I’ve ever booted Graphene OS on a tablet. I’ve been waiting for the larger display for a long time, so this is pretty awesome.
So if we go back to the post-installation instructions, we can see “Disabling OEM unlocking.” So we want to complete that step, so we’re going to go into Settings, scroll down to “About phone,” we’re going to tap “Build number.” Once we see this screen, enter your PIN code.
We are now developers. We can see on the bottom. Go to System, and then back to Developer options, and then disable OEM unlocking. Please restart the device to enable the device protection feature. So I’m going to hold down the power button and then select “Restart.”
So my camera is saying it’s going to overheat. Let’s hope it doesn’t overheat.
There’s more information under “Verifying installation” and some other details down below regarding hardware-based attestation. I would suggest you give that a read-through. I’m not going to cover that in this tutorial.
And so once your device boots up, we can swipe up, enter our PIN code.
And you are now ready to start using Graphene OS on your Pixel tablet. So if you’re looking for an easy way to get started and to start downloading apps, Graphene OS offers sandbox Google Play services. They are very easy to install. I’m going to run through that quick. First step is we need to connect to Wi-Fi, so I’m going to go into Settings > Network and internet, select my Wi-Fi network.
So once you’re connected to Wi-Fi, we can swipe up again, go back into the app drawer. We’re going to go into the Apps app. You can then go to Google Play services, tap “Install.” This will take a few minutes depending on your internet connection. You’ll see a few pop-ups. Tap “Install.”
So once that finishes, you can swipe up to go to your home screen. Going to swipe up again, we can now see Play Store is installed. If you’ve ever used Android OS before, this is going to be very similar to the Google Play Store. There’s a lot more information on the sandboxed Google Play services on grapheneos.org, which I’ll link down below. But I’m not going to cover that in this video.
So again, this is just a basic setup if you’re just getting started, want to experiment, and mess around. You can make a fake Google account and sign in with that just on your tablet to use. And if you don’t like having Google Play services on your device, you can always erase your device and set it up however you prefer.
So, if you made it this far and are not tired of hearing me talk yet, I do have a monthly newsletter that I send out. You can sign up for that at sideofburritos.com. I send out random text stuff and non-text stuff. You might like it or you might not, but you can always unsubscribe.
So, my camera just shut off that was recording the tablet, but we’ve reached the end of the installation process. If you’re looking for a good resource on Graphene OS-related information, check out the forum that they host. You can go to that at discuss.grapheneos.org. And if you enjoyed this video, I think you might like the top one listed here, and the YouTube algorithm thinks you might like the bottom one.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
I have been waiting a while for this product to be released. This is the Google Pixel tablet. I was initially going to make this an unboxing video, along with a few first impressions. But 12 hours after receiving this tablet in the mail, I saw this tweet from the Graphene OS team that they had an initial build ready. So, I thought I would test it out. This is not going to be an installation guide video; that will be coming out shortly after this one, and I will link it down below once it’s ready.
So, as we can see in the box, this is the Pixel tablet with charging speaker dock. So, that’s kind of cool to include that for free. I went with the 128-gigabyte version; that’s what I normally get whenever I buy a Pixel device.
So, we have two strips on the bottom. First, we have the tablet. Let’s get that out of the way. I’m going to set that aside for now. And then underneath the tablet, we have some instruction pamphlets. It tells you how to use the dock, tells you how to get startedβpress the power button, follow the instructions. Thank you, Google.
Here we have the dock that comes with it, and then we have a charging cable just for the dock. This wall adapter is just meant to be plugged into the dock directly; it doesn’t have a USB-C connection, so you can’t use it with a tablet. But the dock does charge the tablet, so you can always charge it that way. So, let’s get this box out of the way.
So, this is the dock for the tablet. I believe it’s also a speaker, has a nice fabric finish to it.
So, this is everything in the box: you have the tablet, the dock, and the power adapter. Pretty simple, nothing much. So, let’s take a look at the tablet.
On the back, it’s plain, kind of has a soft finish to it. I believe it’s metal, but there’s some kind of coding on here which feels kind of nice. We have the reflective Google logo in the center, along with the four pins that correspond to the four magnetic pins on the dock as well.
So, the actual tablet is a 10.95-inch screen. The resolution is 1600 by 2560. It has an 8-megapixel camera, and it also has the Google Tensor G2, which is the same as the Google Pixel 7. So, just for a quick size comparison, my camera can focus on the front screen. Here is a Google Pixel 6A laying on top of the tablet. So, as you can see, it is much larger, as is to be expected from a tablet.
On the bottom, we have a couple speaker holes along with the USB-C port. On this side, there are some rubber bumpers here, and on the other side, we have what looks pretty similar to a Pixel phone. We have a power button, which is recessed into the actual body of the device, and then we have a rocker, which I’m assuming is for volume.
On the front, it might be tough to see, but we do have a circle there, and that is where the front web camera is. And on the back is the rear camera. So, let’s go ahead and turn this on. Hold down the power button.
So, usually these devices come charged, but it looks like this one is… up there it goes. I’ll give this a minute to start up. This currently just has stock Android OS on it. I’ve never turned this on before, so this is the first boot. We have the standard walkthrough screens.
I’m going to set up offline. I’m just going to walk through this quick.
So, here we are at the home screen. Let’s go find the one part that actually matters, which is OEM unlocking.
So, this looks like it’s similar to mobile devices where you need to connect to the internet to enable OEM unlocking. But for now, I’m going to take a break from this video. I’m going to go ahead and make the installation video, and I will be back here shortly.
So, after I finished filming the installation video, I ran out of time. So, here we are, the next day after I completed the installation. I just powered off the tablet. So, let’s turn this on and take a look.
We have our standard screens you expect to see with Graphene OS and an alternate operating system installed.
One of the most shocking things, I think, so far is just how large this screen is. After using Graphene OS on a handheld device for the past two years, it’s very odd to see it in such a large form factor.
I didn’t realize yesterday, but the buttons are actually on the left side of the device, unlike the mobile devices where the buttons are on the right side.
Don’t make your passcode one, two, three, four, five. So, here we are, Graphene OS on the Google Pixel tablet. If you’ve ever installed and used Graphene OS before, then you might be familiar with the bare screen that you are presented with, which is a reminder of just how minimal this operating system is. We just have the default apps you expect to see.
Like I mentioned in the intro, there’s not going to be much to go into in this video. I just kind of wanted to show that it works, what it looks like, my initial first impressions, which there’s not much going on, so not much really to tell. I will have a much more in-depth video in the coming weeks, so stay tuned for that one.
But if we just poke around again, it’s great having such a larger display.
Now, since I don’t have much to actually talk about the user experience in this video, I did want to talk about why I bought this tablet and what use case I think it can offer. For me, at least, this is much easier to travel around with, the larger display. It’s not annoying to use. If I need to do something technical with terminal, it’s easy on this display, especially with landscape mode.
You get the full experience. It’s like a full-screen computer, and at a 10-inch screen versus the smaller mobile device. And one of the things I recently purchased to use with this, I was actually looking at upgrading the mechanical keyboard I had to something that’s a little bit easier to travel with. So, thank you to my friend who recommended this, the HHKB. So, this is a Bluetooth keyboard. It does not have a dongle. That’s important to note. So, I wanted to make sure that this would actually work with it. So, I’m going to test that out now and see if I can pair it with the device, because to me, if you can get this on a stand and have a keyboard paired with it, at that point you have a nearly fully functional computer, at least for my use cases. That can work, and it’s compact, easy to travel with. So, let me pair this quick.
There’s the keyboard. Looks like it has paired successfully. So, let’s just test out this text box up here.
That looks abysmal on camera. Let’s try something else.
So, the keyboard does work. That’s pretty awesome. I did order the case for this that comes with a kickstand for it. So, at that point, you kind of have a computer display that you can use.
The other reason I was very excited for this device is that this retails for $499 in the US, and I’m not aware of anything else you can get that is as secure and private as the default installation of Graphene OS for that price point. Yes, you can throw Linux on a laptop and have a high level of privacy, but there’s nothing at this price point, especially in this form factor, that offers this level of security and privacy combined. So, at this point, I think this is one of the most secure and private devices you could purchase. And with a larger screen, it’s extremely usable.
The other thing I really like about this device is it’s Wi-Fi only. I’ve been in the tech industry for over 10 years, and from everything I’ve seen about cellular technologies, I still don’t think there’s a great way to use them in a secure and private manner. You’re always triangulated when you’re connected. And yes, some services exist to help anonymize you or to spoof some of the data that’s used when you are connecting to those services. But at the end of the day, I think it’s a broken technology.
So, now when it comes to Wi-Fi and Ethernet, those technologies I understand, and there are good ways to remain private and secure while using them. So, there’s no need to disable cellular connectivity because it does not exist on the tablet.
So, one last thing I want to cover is I did read there might be some initial issues with the dock if you didn’t first set up the dock using stock Android OS. So, I just want to test that quick. From what I understand, the smart features of the dock don’t work on Graphene OS because those require system-level Play services, and on Graphene OS, sandboxed Play services are installed as normal apps. Therefore, it will not function. But again, it’s still too early to tell, but that’s what the initial feedback was I saw from the developers on Twitter.
So, the audio works on the tablet, as to be expected.
Here’s a YouTube ad, of course.
So, the dock should also function as a speaker when you plug it in. So, I want to test that out quick. Let me plug in the dock.
So, there’s nothing indicating the dock is plugged in once you do plug it in. So, I guess it’s just on. So, there’s a sound that does come out of the dock when you plug it in. So, I guess it’s booting up or turning on. And now we can dock the tablet with the four corresponding magnets.
Those are extremely strong magnets. So, if we look here, we can see the tablet is charging. So, the charging functionality works. Let’s see if the audio works.
And so, I can confirm that just by doing that, the audio on the speaker is working on the dock. So, it seems like that does work. There’s no initial setup needed on the stock Android OS.
As to the other smart features of the dock, like I said, those probably or likely will not work in the future. At least they don’t work at this time.
So, to sum up my five minutes of usage with this tablet, I’m extremely impressed that within 12 hours after its release, the Graphene OS team had the initial build out there. So far, from my basic usage, it works well. It’s also worth noting this is technically a first-generation device. So, if you’re looking for something that’s perfect from a hardware perspective, this is not that. But at the end of the day, I think the software is more important. And with Graphene OS, we know that it’s going to be a secure and private device. And I think, in that regard, it’s going to be a really good device for people who are looking for something at this price point.
So, if you’re interested in more videos about this tablet, let me know down below. I think in the future I will be making a video about that custom stand I got, as well as any other use cases I find for this device. So, let me know if you’re interested in that. I’ll have a lot more coming out shortly, so stay tuned.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
Six months ago, I made a few videos on F-Droid and why you should stop using it. Shortly after the release of those videos, someone sent me a project on GitHub that says in the readme it was motivated by one of those videos. I didn’t start using it then, but I kept an eye on the project.
Now, just over six months later, the project has over 900 stars on GitHub, and it has come a long way, to say the least.
In my original video, I covered how you could manually add the source for APKs you wanted to track and download to an RSS reader. While this method did work, it was cumbersome.
The app I’m talking about today is Obtainium, and it aims to automate the process of tracking and updating apps. While it doesn’t solve the inherent problem with F-Droid and third-party app repositories, I do think it provides some viable alternatives to help reduce or even eliminate some of those concerns. As always, you should use my advice and experience as a starting point for your own research. Make sure to test and validate everything you hear, especially if you are considering using it.
I’m going to cover a few use cases and then talk about my experience the last two weeks using Obtainium on my main device, a Pixel 7. The demo you see today will be from my testing device, which is a Pixel 6A.
So, to obtain Obtainium, we’re going to head on over to the official GitHub page. All links will be down below in the description box.
So, we’re going to open up our browser and search for Obtainium GitHub. And this first one here is the one we want. And if you scroll down, we’re going to select the “Get it on GitHub” under installation. We’re going to expand the assets, and the one we want to select for the Google Pixel is the “app-arm64-v8a.”
Select that, download anyway. Once that finishes, select “Open.” If you’ve never used your browser to install an app before, you’ll have to allow this permission. Once you see the install window pop up, select “Install.”
Done, and we have now obtained Obtainium. You should now see it on your home screen, or if you swipe up, it should be in your app drawer. Ignore the X Recorder; I’ve had some issues with the built-in Android screen recorder, so I’m trying a different one.
You can now open the app, allow notifications. Notifications are done locally, so there’s no need for Google Play services for notifications to work.
And I first want to start off by saying how refreshing it is to use an open source app that took design into consideration. I’ve noticed a lot of times that aesthetics is an afterthought, which is fine, but I think it hurts long-term adoption. I personally have motivation from a security and privacy perspective to use an app, even if the interface is less than ideal. Others who might not have as strong of a motivation to use an app could get quickly turned off by its looks.
So when I first opened Obtainium, I was pleasantly surprised by the design. The developer is very active on this project, so what you see on my screen right now might not be what you see if you’re watching this video in the future, but the general overall concept should be the same.
Going through the interface, the first option is the apps. This is our apps list that we’re tracking. Obtainium is added here by default so it can track and update itself, so that’s pretty handy. We have add app, which we’ll come back to shortly. Then we have import/export. If you’re currently using an RSS reader like I talked about in my previous videos, there’s an option here to import from URLs and file like OPML. The Repla app, the main export type that I had was OPML for its backups, so you could perform an export from that and import it to Obtainium. I didn’t test this functionality; I just manually added the apps that I wanted. You can also perform an Obtainium export, so once you get everything set up, that’s handy. You can export it, save it, and then if you switch devices or your phone gets lost or stolen, you can always import that backup so you don’t need to set it up all over again.
The last option on the bottom is settings. I just left this set to the default, but feel free to change anything you might want.
Now let’s add our first app. So select add app. We can see down here listed are the supported sources, and if we look next to GitHub and Codeberg, those are labeled as searchable. So in the second box here, we can search for an app. In this case, I’m going to search for NewPipe because that’s on GitHub. Search, so you’re going to be presented with a lot of results, especially for a project that’s popular. But this first one here is the official one, Team NewPipe. Just to be safe, I always suggest that you check first to validate that it is the correct one. So let’s go to that repo. We can see here, this is the correct one, the official NewPipe. So once you validate that, we’re going to go back, select the first one, and then press pick.
There’s a separate section for additional options for GitHub. The first one is to include pre-releases. By default, you should leave this unchecked.
Prereleases technically aren’t releases that you should be using, so that’s why it’s left unchecked by default. The next option is fallback to older releases, and that is enabled by default. This option is for when developers on GitHub do not do the releases correctly, and they might have one release for iPhone and one for Android. If they are listed in different releases, when Obtainium goes to check what the latest version is, if the iPhone one was released latest, it will see that there’s no Android APK available to install. Therefore, this option lets it fall back to an older release, which would be the Android version, and you can then update that.
Probably sounds confusing, so just leave that enabled like it is. There’s another option here for filter release titles by regular expression. Again, this is for edge cases. I haven’t needed this yet for any of the apps I’m tracking on my main device. The last option down here is for track only, and what this will do is it will just track it and will not actually try to download the updates and let you install them. I leave this disabled because I want Obtainium to download the APKs for me so I can install them, and then standard version detection, I just leave that set to the default. So those are the options that are listed.
We can now select Add. Obtainium needs permission to install unknown apps, a lot from this source. Let’s go back. You’ll see this screen next. We can see latest version 0.25.0 installed, a version none. I want to install it. Install done. And now if we go back to our apps list, we can see New Pipe is now here and being tracked. Latest version 0.25 installed version 0.25. Nice clean interface, and as expected, New Pipe is installed.
So, I know that took a few minutes to go through and talk about, but in reality, it only takes 30 seconds to add an app, and now in the future, Obtainium will check for updates in the background and notify you when they are available. As always, you should be skeptical of anything open source or any app for that matter, especially something that will be installing apps on your behalf or for you. So one extra precaution that you can take is to install the app manually first from the source, and then add it to Obtainium. When you install an app, Android pins the certificate and enforces signature checks for app updates, so even if something malicious was happening with Obtainium, it wouldn’t be able to install a malicious app update because the signature check would fail.
So as an example, let’s go ahead and install Dev X5. I know their source code is on GitHub, so I’m going to search for that. I know this is the official repo for it. I’m going to go to the releases and download the latest one. Let’s open and install that.
So now at this point, Dev X5 has been installed. We downloaded it from the trusted source that we know; therefore, the certificate has been pinned by the OS. So any updates that are installed either manually by us or using Obtainium must pass the signature check, which means that the APK is signed by the developers. We can see Dev X5 was installed. Let’s now add it to Obtainium. We just copy this URL, go back to Obtainium, add app, paste in the URL, select add. We can see that it found that Dev X5 is installed, latest version 4.3, installed version 4.3.
There’s no updates to install. So now, if we go back, then go back to the apps list, we can now see that DAV X5 is listed there. We installed it from a trusted source, and now we’re going to let Obtainium handle any future updates.
There are a few other caveats or features that I want to go over. So, going back to the “add app” option, we can see here that Malvad and Signal are both listed as sources. If we select one of those, Malvad publishes their APK on their website, so we can just copy this, and Obtainium on our behalf will find the APK for us and download it.
Select “add,” and we can see in the background downloading Malvadvpn. So it’s pretty handy that the developer went ahead and built in this functionality for us already. Even though we’re not actually adding the exact page the APK is on for the apps listed there. In this case, Malvad and Signal, the app automatically knows where to look. It’s a good minute to finish.
Once it finishes, we’re prompted to install. Now, if we go back to the apps list and refresh, we can now see Malvad is shown here and being tracked.
Just to show an example of what updates look like, I went ahead and installed an older version of New Pipe. You’ll receive a notification, and then when you go inside the app, you’ll see a notification next to the app that needs to be updated. In this case, New Pipe. Select the purple download icon, and you can see the download. So Obtainium went ahead and downloaded the APK for us. We now select “update,” and now New Pipe was successfully updated.
One of the easiest ways to find where the source code for an open-source app is hosted is to use the F-Droid website. So if we go to f-droid.org in our browser and then scroll down and let’s search for New Pipe as an example, the second one is the one we want.
To access the source code for the application, we need to scroll down to the section above the donate button and click on the link to the source code. By examining the URL, we can see that the source code is hosted on GitHub. If we scroll down further to the releases section, we can see that NewPipe publishes their APK on GitHub, which means Obtainium can download it from there.
Returning to fdroid.org, we can find that some developers only publish the APK on F-Droid, even if they have already published the source code on GitHub. As an example, let’s search for a productivity app that starts with “Good Time,” which is the fifth one down. Looking at the source code, we can see that it is also hosted on GitHub. However, when we scroll down to the releases section, we notice that they do not publish the APK on GitHub; only the source code is available. In this scenario, our only option is to return to F-Droid, copy the F-Droid link, and paste it inside Obtainium.
After adding the app and pasting the F-Droid URL, we can see that Obtainium found the app and we can proceed to install it. Upon returning to our list of apps, we can see that Productivity is now installed, and it shows that it is signed by F-Droid.
Using Obtainium is still a better option than the official F-Droid app because it avoids some of the shortcomings mentioned in the previous video, such as targeting out-of-date SDKs. Although the process might seem complicated, it is relatively simple once you go through the steps yourself. It has made the process of downloading, installing, and updating apps much more accessible for the past two weeks, and the update functionality and tracking have worked flawlessly. The experience so far has been enjoyable, and the plan is to continue using it.
However, there are a few limitations to be aware of that are listed on the GitHub readme. The first one is that app installs occur asynchronously, and the success or failure of an install cannot be determined directly. This results in install statuses and versions sometimes being out of sync with the OS until the next launch or until the problem is manually corrected. If you notice any unusual behavior, close the app and relaunch it.
The second limitation, which will be revisited later, is that auto unattended updates are unsupported due to the lack of a capable Flutter plugin. Also, for some sources, data is gathered using web scraping, which can easily break due to changes in website design. In such cases, more reliable methods may be unavailable, and scraping is an unreliable method to gather data. If you have ever used NewPipe and noticed that it broke randomly because YouTube changed its layout one day, that is a similar situation to what the developer is describing here. It is not the app developer’s fault, but rather the nature of web scraping.
Regarding the second limitation mentioned above, before making this video, the app developer was contacted to see if there was anything specific they wanted to mention. They requested that any Android developers watching the video take a look at issue number 25, linked below, to help complete the auto-update feature before releasing version one of Obtainium. Contributions to help with that would be greatly appreciated.
Overall, using Obtainium has been a great improvement and has made the manual tracking process much more efficient. Although it is not a solution to the underlying problems that still exist, it is a step in the right direction. The plan is to continue using it, and there are no plans to go back to the RSS reader method.
And while it’s not a solution to the underlying problems that still exist, which I covered in my previous videos, it is a great improvement and makes the manual tracking process much more efficient. So, I hope you enjoyed this video. If you did, check out this top one here, and the bottom one has been automatically selected for you.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
The other day, someone sent me this video from The Wall Street Journal. It was a good video, so if you have some time, you might enjoy watching it. The video covered a situation that’s occurring where someone will be at a bar. An individual or a group of individuals will either observe or befriend a Target to determine what their pin code is as they enter it into their device. As it’s normal for someone to enter their pin code multiple times while they are out for the evening, they have various chances to figure out what it is.
Once they figure out what the PIN code is, they either swipe the iPhone when the suspect is distracted or they forcefully take it. Now, what happens after that is quick and calculated. The thieves using the PIN code are able to change the victim’s password associated with their Apple ID, thus locking them out of their account and rendering finding my iPhone unusable. Once that step is completed, the thieves start draining any Financial accounts on the user’s device that uses the PIN code to authenticate. In addition, if the victim uses the iCloud keychain chain, the PIN code can also be used to gain access to that which would then allow them access to any accounts stored in there.
The video goes over in more detail, and if anyone you care about uses an iPhone, consider sending them the video to make them aware of the situation so they can be more cautious. I will also link a post below that has some advice for iPhone owners on steps they can take to protect themselves.
In today’s video, I wanted to cover some settings and suggestions you can implement on graphene OS to help with these kinds of attacks. While it’s not the exact same scenario, I do think these are useful options. So, the example scenario is that you have a Google pixel running graphene OS, and either you or you and your friends decided to go out and grab a bite to eat or some drinks at a local bar.
The first suggestion I want to make for this type of scenario is to use biometric authentication, which is a fancy way of saying to use your fingerprint. To access that setting, you can go into Settings > Security > Fingerprint unlock. Enter your passcode and you can then set up a new fingerprint to authenticate with. I know some people don’t like the idea of using biometric authentication, but the main advantage that using your fingerprint has for authentication is that you can’t shoulder surf a fingerprint. Someone can’t observe you and gain access to your fingerprint. So in a social setting where others might see you enter a PIN code on your device, using your fingerprint can avoid this altogether.
Graphene OS also has a quick option to disable the fingerprint reader. So let’s say you’re going through TSA at the airport or a police officer pulls you over, you can press and hold down the power button and then select “Lockdown.” At this point, biometric authentication is disabled and you need to enter your PIN code to access your device. If you aren’t comfortable using biometric authentication, another useful feature is pin scrambling. To access that, go into Settings > Security > Pin scrambling. Go ahead and enable that. What that does is, on your lock screen, the PIN code will be scrambled every time you go to enter it. This means that someone observing you can’t determine your PIN code based on the physical location of your finger on the screen when entering your PIN code. And while it’s not guaranteed that they can’t determine what your PIN code is, it will make it much more difficult and hopefully deter them enough that they pick an easier target.
And while we are on the topic of PIN codes, the longer the PIN code, the better. It’s going to be much more difficult to determine a 10-digit PIN code compared to a four-digit PIN code. My next suggestion is to use a separate user profile with a different PIN code from your main owner profile, specifically for situations where you’re in a public setting with a large amount of individuals around who could watch you enter your PIN code into your device.
To do that, we’re going to go into Settings > System > Multiple users > Enable “Allow multiple users” > Add user > Set a name for your new user profile. For this example, on this restricted user profile, I’m going to leave phone calls and SMS disabled, but as far as apps go, I do think it would be helpful to have NewPipe installed in case I need to look up a video to show someone. Other than that, I won’t install any other apps. The “Install available apps” feature is a convenient feature to install apps on separate user profiles so that you don’t need to install a separate App Store on the other user profile.
Separate user profiles are a great way to keep your sensitive apps like banking apps separate from a profile you’ll be using in a public setting. So now that we have our new user profile created, you can switch to that by either tapping “Switch to” and your profile name or you can swipe down, pull down again, tap the user icon in the bottom right, and then select your new user profile.
So you won’t be able to see it in the screen recording because it stopped recording when I switched, but all I did was go through the initial profile setup and set a different pin code for my main owner profile. So now here we are in the new user profile. If we swipe up, we can see NewPipe was installed, but Signal was not installed. So now at this point, we have a separate user profile created with a different pin code from our main owner profile that we can use in public settings so that in a worst-case scenario, if someone does get our pin code, they won’t have access to our main owner profile with our sensitive data.
I also want to note that every user profile has separate settings, so you will need to enable pin scrambling on this new user profile we just created. The last setting I want to talk about is auto reboot, and this setting is only accessible from the main owner profile. So make sure you switch back to that user profile. To access that, go into Settings > Security > Auto reboot. I like the 12 hours option. What this setting does is it will reboot the phone if there hasn’t been any successful unlock within the timeframe selected. This puts the device fully at rest in a pre-first unlock state, which is the most secure state for your data.
The reason this is useful for us is if we’re logged into that separate user profile, worst-case scenario someone finds out our pin code, they swipe our device, they now have access to that restricted user profile. Once there is no successful authentication within 12 hours, the device will reboot itself. And now at that point, they need to enter the main owner pin code, which is required to unlock any separate user profiles. The entire device is now inaccessible to them since they don’t know the main owner PIN code, and therefore they cannot access that separate user profile we created. For all intents and purposes, your device is a brick to them.
Probably the best protection, at least in the United States, is the fact that you are using an Android device. Most thieves target Apple devices because they have a great resale value and just how connected they are to everything else on the device. So an Android device being less premium is a solid defense.
Those are the ideas that I came up with. If you have any other suggestions, feel free to leave those down below in the comments. And if you enjoyed this video, I think you’ll like the top one shown here, and the bottom one has been selected for you based on your viewing habits.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
The default boot order on the Raspberry Pi is to first boot from the micro SD card, which is less than ideal if you would like to boot from a USB drive first. So, in today’s video, I’m going to cover how you can change the boot order on your Raspberry Pi.
To begin, you will need Raspberry Pi Imager. For this, if you’ve never used it before, check out my video linked on the screen now and down below where I go over the basics and how to install it.
Once you open Raspberry Pi Imager, select “Choose OS”, scroll down, and select “Miscellaneous utility images”, and select “Bootloader”. Then, select the option for USB boot which boot from USB if available, otherwise boot from SD card, which is exactly what we want.
So, once you select that, the next step is to choose a storage device. For this example, I’ll be using a Micro SD card, but make sure whatever medium you decide to use, you don’t have any data stored on it that you need to keep because this process will completely erase it.
So, at this point, connect the SD card to your computer. Once that’s connected, select “Choose storage”, select your storage device, and then before we click “Write”, just double-check that you have USB boot as the operating system, the correct storage device is selected, and then go ahead and click “Write” again. Just a warning that all existing data will be erased. Are you sure you want to continue? Yes.
The USB boot image is very small, so this should take less than 30 seconds. Once it does finish, you can select “Continue”, and we can now remove our storage device from our computer.
So, at this point, we now have our Raspberry Pi. I’m going to go ahead and insert the micro SD card into it, and now the next step will be to power it up. I’m just going to switch my camera to my computer screen so you can see what it looks like. If you don’t have a monitor to connect your Raspberry Pi to, that’s perfectly fine. Just power up your Raspberry Pi, let it sit for 30 seconds, and you should be all set.
As you’ll see in a moment on my screen, the Raspberry Pi will power up from an image we just flashed to our micro SD card, and the bootloader will be reconfigured to boot from the USB drive first and the micro SD card second.
So, at this point, I have my Raspberry Pi connected to my monitor, and I have the micro SD card inserted in the Raspberry Pi. I’m now going to power up the Raspberry Pi.
Once the green screen shows up, that means that the boot order has been successfully reconfigured, and now our Raspberry Pi will boot from USB first and micro SD card second. If you enjoyed this video, I think you’ll like the top one listed here, and the bottom one has been automatically selected for you.
]]>Auditor App
GrapheneOS Camera
GrapheneOS PDF Viewer
GrapheneOS Vanadium
Settings
Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
I received a message recently that asked if I ever considered doing a tour of GrapheneOS. This individual was interested in seeing what the operating system was like just after the install before they actually set it up on their own device or purchased one to use it with. I thought it was a great idea, so if that sounds like you, then I think you’ll enjoy this video.
Before we start, I do want to mention that the best source for information is always going directly to the source. The GrapheneOS Project does a fantastic job documenting the features, usage, and some commonly asked questions, all of which will be linked down below.
This is a Pixel 6A running the latest version of GrapheneOS. All I’ve done is go through the initial setup screen, which I talk about in my install video. I’ve connected to Wi-Fi and I’ve changed the display to Dark theme to make this video a bit easier to watch.
So, this is the home screen. It might feel a bit barren; it might be a shock at first, especially if you’re coming from a stock OS that’s bundled with apps. So, we’re going to swipe up and go through each app individually in the app drawer.
The first app is called “Apps.” This is the official GrapheneOS app repository. It tracks and updates GrapheneOS apps, and it lets you install Google Play services. So, now going back to the app drawer, the next app is the “Auditor” app.
This app uses hardware-based security features to validate the identity of a device, along with the authenticity and integrity of the operating system. It will verify that the device is running the stock operating system with the bootloader locked, and that no tampering with the operating system has occurred. A downgrade to a previous version will also be detected. This is one of those features that doesn’t get enough credit.
I really need to do a deep dive on this topic, but I haven’t yet. I do use the remote attestation feature and the process for that is documented here. Give this a read-over; it’s a very useful feature. Here, we have the calculator app. This is for doing math. This is the AOSP version of the calculator app. Nothing too much else to say about that. This is the official Graphene OS camera app. It’s based on Android’s camera X Library, and it works well. This is all I use. Following that, we have the clock. This is just the standard AOSP clock app; alarm clock, timer, stopwatch. Next is Contacts. This is the AOSP Contacts app. You can import and store your contacts locally, or you can use an app like Dev X5 to sync your contacts with a cloud service.
Following the Contacts app, we have the Files app. This is another AOSP app; it’s simple, but it works well. The main things I do with it are rename screen recordings or copy them to an external USB drive. Besides that, I don’t do much else in here. Next, we have the AOSP Gallery app. It’s simple, doesn’t have a ton of features, but all I use it for is browsing my photos. After that, we have the AOSP messaging app. It works fine for sending and receiving SMS messages. Most of my communication takes place over Signal. SMS is not encrypted, so I would suggest you use something like Signal, which is encrypted and secure, and try to use SMS as little as possible.
Next, we have PDF viewer. This is a simple Android PDF viewer by Graphene OS based on pdf.js and content providers. This app doesn’t require any permissions. The PDF stream is fed into the sandboxed WebView without giving it access to content or files, which is pretty cool. The app works well for me, and all the PDFs I’ve opened on my device have been formatted correctly to read. Following that, we have the AOSP Phone app. Similar to the messaging app, most of my voice communication takes place over Signal, so I don’t use this app much, but when I do, it works well.
After that, we have Settings. I’ll come back to this shortly, and lastly is Vanadium. Vanadium is the stock Graphene OS browser maintained by the Graphene OS team. It’s a privacy and security-enhanced release of Chromium. It also provides the WebView and a standard user-facing browser on the OS. This is the only browser I use on my device, and I’ll link a video down below where I talked more about Vanadium and my configuration if you’re interested.
Now, back to the Settings app. If you’ve ever used Android before, then this should look pretty familiar to you. There are a few options that Graphene OS offers that I like to enable. The first is under the Network and Internet. If we select our Wi-Fi network that we’re connected to, the network preferences, there’s a setting here to turn off Wi-Fi automatically. I like to change this to 10 minutes. This is helpful so that when you leave your home or wherever you’re connected to Wi-Fi, your phone is no longer scanning for available Wi-Fi networks or saved networks.
Similar to the auto-off for Wi-Fi, there’s a similar setting for Bluetooth. So under connected devices, Bluetooth timeout, I like to set this one to two minutes. And again, I enable this for the same reason I enabled the auto-off for Wi-Fi. It is a minor inconvenience that you need to manually turn on Wi-Fi or Bluetooth when you want to use them, but I think the benefits outweigh the inconvenience that it causes.
Now, the last two settings that I like to enable: the first is auto reboot, which is under security Auto reboot. For me, I like to change this to 12 hours. So what this does is, if your device has not had a successful unlock within the time period specified, your device will automatically reboot. This puts the device fully at rest in a pre-first unlock state, which is the most secure state for your data. This is a useful feature if your device is lost, stolen, or taken.
And now, the last feature I want to mention is on the same page, and that is pin scrambling. This feature does exactly what it says; it scrambles your pin on the lock screen. I find this feature extremely useful in public places. So, if someone is watching me type my PIN code on my screen, they won’t be able to tell which numbers I pressed just based on the physical location of my finger.
These settings are all just preference; you don’t need to use them. But I will link the relevant documentation down below if you would like to read more about them. So that was my tour of Graphene OS. It was a basic overview, but hopefully, it can give you a bit more confidence in case you are hesitant about installing it. So, if you enjoyed this video, I think you’ll like the top one here, and this bottom video was selected for you by the machines at YouTube.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
Raspberry Pi Imager makes it easy to install a variety of operating systems onto your micro SD card, external SSD, or whatever other medium you choose to install your operating system on for your Raspberry Pi. They make it super easy to install. You can head on over to raspberry pi.com. Once you get there, select “Software” and then, depending on which operating system you are running, select that download. In my case, download for Windows.
Once the download finishes, open it. Do you want to allow this app? Yes, follow the prompts. Once that finishes, select “Finish.” There is one setting I like to change before I use it. The setting I like to change is located in the advanced settings. To access that on Windows, you need to hit Ctrl, Shift, and X on your keyboard, and you should see this screen pop up. Once this shows up, I change this to “Always use,” and then I scroll down to the bottom, and the setting labeled “Enabled Telemetry,” I uncheck that and then select “Save.”
The detail on the GitHub page, which I will link down below, explains what Telemetry is collected, the URL, operating system name, and category if present, of a selected image are sent along with the running version of Raspberry Pi Imager, your operating system, CPU architecture, local, and Raspberry Pi revision if applicable to this URL. And then they go over the web service that it’s sent to, where it’s hosted and why they do it, which is to allow them to query the number of downloads over time and nothing else. I personally don’t think there’s anything malicious about the Telemetry they want to collect, but since the option is easily accessible, I like to disable it.
So, at this point, you can now browse the OS’s that are available to install through the tool. They have the default Raspberry Pi OS, a popular section I like to use, as well as other general-purpose OS. In here, they have Ubuntu, which is what I’ll be using in my demonstrations in future videos. They have some useful options under “Miscellaneous Utility Images” and under “Bootloader.” From here, you can change the boot order of your device. So, if you want to boot from USB before SD card, you can configure that from here.
I just wanted to give a quick overview of what this software offers. In a future video, I’ll walk through the install and booting up of our freshly installed OS on our Raspberry Pi. If you enjoyed this video, I think you’ll like the top one here, and the machines think you’ll like the bottom one.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
FUD stands for “fear, uncertainty, and doubt.” It’s a popular term used a lot in the privacy community, and leads me to a topic I’ve been wanting to talk about: best practices when researching and analyzing information on the internet. I will be referencing an article written by a security researcher about Apple. I am not making this video to defend or shill Apple, but because I believe that real conversations about privacy and security should be based on facts, not lazily written articles attempting to lead readers down a path the author wants.
The article was published on January 15th, 2023 and has a very intriguing title. However, my skepticism kicked in and I looked into it some more. A lot of information is out there and, sadly, catchy headlines are the ones that get shared first without much validation.
So, let me take you through my process when evaluating an article, especially one that I am considering sharing with an audience. When I first get to the page, I see the title. In the sidebar, I quickly read about the author, who is a hacker and security researcher living in Berlin. After reading that, I think that the information should be technical with a lot of detail. However, the title, “Apple has begun scanning your local image files without consent,” is a very strong claim to make, and I would expect something equally strong in the writing to back that up.
The author starts off with a preface, explaining that they don’t use iCloud, Apple ID, Mac App Store, or store photos in the Mac OS Photos application. They use Mac OS software on Apple hardware.
The author then describes using a program called Little Snitch, which alerts them to network traffic attempted by the programs they use, and that they have all network access denied for many Apple OS level apps. They then start browsing some HEIC files in a subfolder of their documents and Little Snitch tells them that Mac OS is now connecting to Apple APIs via a program named “media analysis daemon,” a background process for analyzing media files.
Instead of reading more detailed technical analysis and information, the author just starts to talk about Apple’s client-side scanning for CSAM in 2021, and how they retracted it because of a public backlash. The author talks about the need to read Apple’s statements carefully and how they are very good at writing technically truthful things that say one thing, but cause reporters to report a different thing.
The article concludes by reminding readers that if they have nothing to hide, they’ve done nothing wrong, and it’s most important to limit information in those times.
So, to put this in perspective, the first few paragraphs gave the preface and some background on what the author found. Everything else talked about Apple’s CSAM scanning, how they’re bad, and the government. When I read an article and someone gives me one or two paragraphs with technical detail and then the following 10 paragraphs are about an event they want me to remember, that’s a little suspicious and I feel like I’m being led down a path to correlate events without the author actually saying that.
So, after reading that, I had some hesitation about actually trusting what I read in this article or about what the author found. So, the next thing I like to do in that case is to actually search for the title of the article and see what else shows up. See if anyone on the Internet is talking about it. Typically, if it’s a newly published article, I’ll search for it on Google because they usually index first before other search engines. So, in this case, we’ll search for the title, and we can see here I actually clicked it in the past. But one of the first results is for Hacker News.
This is a forum where information can be posted and shared, and people can comment on it. And we can see here, the article is posted 25 days ago. This is the site we were on reading it. Sneaked up Berlin. You might notice it was published by sneak, and if we go to this website, we can see most of the handles the author has are sneak. We don’t see the Hacker News one listed here, but if we go to the home page of the website, they list that their Hacker News handle is at sneak. So, we can confirm that the author is the one that posted this on Hacker News. We can also see the article was flagged, and if you start reading through the comments, we can start to see pretty quickly that other people had similar doubts. It talks about the domain that showed up in the author’s image smoot.apple.com is used for spotlight. This article is rightly flagged as BS. This guy found something a little snitch and suddenly exposing some dark company secret in the story.
I understand these are just some strangers on the Internet, but they’re already confirming some of these suspicions I had about this article, and we know that sneak is the username for the author. So, if we search for sneak on the page, we can start to see some comments from the author. “If I made any false claims in the article, please let me know ASAP so I can correct them. I was very careful to report facts only and let the readers draw their own conclusions about what is happening here.” You didn’t report any false claims, you reported a bunch of unrelated claims without any technical research, and then pointed your readers to a conclusion that lacked any technical or journalistic merit.
It’s shallow alarmism, and I want to be clear that I understand people might publish information that’s inaccurate. But if someone goes back then and edits their information or adds something at the bottom saying “you know, after further research this was determined,” but what you find from reading this is that the author chose to die in this hill. I didn’t make that claim because I have not reverse engineered media analysis D to know precisely what it’s doing. And this, I think, sums it up right here. We have a lazily written article where the author found something that they knew would get clicks.
So, nothing that we found is concrete proof of what’s going on, but my trust with him is lacking because instead of adding corrections or addendums to his article, he chose to publicly defend it and continually say that he did not make those claims, even though he employed the same practice that he bashed Apple for, which is Apple is very good at writing technically truthful things that say one thing, that caused reporters to report a different thing.
Now, to contrast the article that was posted by Jeffrey, a miss-put thread on Twitter countered what was actually claimed in that article: no, Mac OS doesn’t send info about your local photos to Apple. We analyzed media analysis D after an extraordinary claim by Jeffrey Paul that it scans local photos and secretly sends the results to an Apple server. They did a thorough analysis of what was claimed by the author to analyze the process, the network traffic. They did all the work that Jeffrey did not do or chose not to do. The unfortunate part is that it’s likely these tweets with actual technical data to back them up did not get the same attention the original article did. They posted an update that this was indeed a bug and was fixed in Mac OS 13.2. This process no longer makes calls to Apple servers.
So, that’s what I do when I find an article that I think is too good to be true, especially if I’m considering making a video on the topic. I do want to touch on one last point on why I think publishing this type of information and letting readers draw their own conclusion is irresponsible. This article had a clear conclusion they wanted the readers to come to, and that’s exactly what happened. Two other popular YouTubers, with audiences much larger than myself, Mental Outlaw and Louis Rossman, both published videos on the topic. In defense of Lewis, he did publish an updated video correcting what he said in this one. If you produce content for a large audience, at least spend a few minutes fact-checking the articles you’re talking about. At the end of the day, people are out there trying to make the best educated and informed decisions that they can. Content and blog posts like this are not helpful and they do more harm than good.
I absolutely agree these companies are doing things that are not good for user privacy, but if we’re going to have discussions like this, they should be based on accurate technical details, not conspiratorial narratives based on fear, uncertainty, and doubt that get clicks and shares. So, if you liked this video and made it this far listening to me talk, I think you’ll like this top video, and the algorithm thinks you’ll like the bottom one.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
It’s good practice to document answers to frequently asked questions, as it allows other users to reference them. For example, I’ve been asked multiple times through email and video comments why a user is unable to install F-Droid in another user profile. To avoid answering these questions individually, I decided to make a video explaining the reason behind this issue. To demonstrate the process, a user can go to f-droid.org on their Android device and click the “Download” button on the home page to download F-Droid. Once the download is complete, they can install the APK.
Open the app, ignore the warning, allow it a minute to update the repositories. Now, if you go to updates because of the notification, the first thing the app wants you to do is update F-Droid to the newest version. The user now has the latest version of it installed. They go through and download whatever apps they want, install them, and then shortly after this, the user finds out about user profiles and wants to start separating their apps to different user profiles to separate user data.
So, they create a new user profile and we’re on that new user profile. And again, the first thing they want to do is install F-Droid so they can download apps. They go to fdroid.org again, same process as before, click the download button, download once the download finishes, open, and install again. And they are presented with an error. This is the error I get asked about and that I see different posts about online.
So now that we see what is happening, let’s talk about why this is happening. This diagram is overly simplified, but I think it’ll help paint the picture of what’s going on. At the bottom here, we have the system and part of the system is the Android Package Manager, which we can see here. And above the system level is the user profiles, as we saw in the example. We had our initial owner user profile that we were on and then switched to our user profile, which was that second user profile where the F-Droid install failed.
A common misconception is that when you install an app on a user profile, it’s installed in that user profile and then when you switch to the other user profile, it’s installed there as well. But that is not correct. What happens when you install an app on Android is that it is handled by the Android Package Manager. That app is installed and then linked, for lack of a better term, to the profile that you are presently in.
In this example, we installed F-Droid from our owner profile. We downloaded it and installed it, which was version one. And as we saw in the example, once we installed F-Droid, we were immediately prompted to update the app, so we went from version one to version two. These are not the actual version numbers. I’m just doing this for the sake of simplicity. So at this point, we now had version 2 of it installed and being managed by the Android Package Manager.
We went to our second user profile, downloaded and installed F-Droid, or tried to install it, but the issue that was occurring was that when we downloaded F-Droid from the website, the version we downloaded was actually version one. Since Android packages are managed by the system, there’s a protection in place that prevents an app from being downgraded. So in this case, we were trying to install version one of F-Droid, but the Package Manager saw that we had version 2 installed, therefore it blocked the install on that second user profile, and we were unable to install F-Droid on it.
Just to reiterate, because it was a misconception that I had as well, user profiles are meant to separate user data. The actual installation of apps is handled at the system level by the Android Package Manager. And if you try to install an app on a separate user profile that is an older version than the one currently being tracked by the Android Package Manager, the install will fail.
You may have noticed that when you update an app in one user profile, the same update is reflected in all other user profiles. This is because the package installation is handled at the system level, not at the user profile level. When the app is updated in one profile, the actual package is upgraded across the system, making all user profiles use the same updated version.
This is why the issue of updating F Droid continually occurs. F Droid hosts an outdated version of their app on their website, so every time a new user visits the site, they end up downloading an older version of the app, which then prompts them for an update. To avoid this, you can download the latest version of the app from the home page and save it in a folder titled “F Droid”. From there, you can search for “F-Droid” on the right side.
We can scroll down to the latest version labeled “Suggested Download”. Again, placing that in the “F Droid” folder. Now, for the sake of simplicity, I’m going to use this online APK analyzer. Here we have our “F Droid” folder with the “F Droid.apk” that was downloaded from the home page and the “org.fdroid” that was the most recent suggested version we downloaded.
If we look at these, we can see that the one from the home page is version 1.15.4, and the version from the actual page in the search was 1.15.6. The 1.15.4 was published on December 2nd, 2022, and the most recent suggested version on January 14th, 2023.
That’s why if you go to a separate user profile and try to download F Droid from the main home page, you receive an older version that’s out of date and the install fails because Android’s downgrade protection kicks in and blocks the install.
Now that we know what is happening and why, there are a couple of things you can do to get around this issue:
Instead of going to the F Droid home page, you can scroll down, search for “Appdroid”, select F Droid, and download the latest version with the tag “Suggested”. When you open this one and select “install”, it’s not blocked by Android because you’re not trying to install an older version of the app. This is probably the easiest for most people.
If you are running Graphene OS, you can go into “Settings”, “System”, “Multiple Users”, select the second user profile, and use the option “Install Available Apps”. Change the toggle next to F Droid, and it will be accessible from your second user profile. The reason the “Install Available Apps” feature works is that APK installation is handled by the package manager at the system level, so when you are in the owner profile, you can give additional profiles access to installed apps.
For the F Droid team, you could update the version on your home page to the latest stable version. It’s not good security practice to intentionally host an outdated version of your app in the most popular place to download it. This one change of hosting the most recent version on your home page would save everyone time and make for a better overall user experience.
If you enjoyed this video, I think you’ll like the top one listed here, and the engineers at Google think you will like the bottom one.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
In today’s video, I wanted to cover the hardware components on the Raspberry Pi. Understanding what you are working with is helpful and I find it impressive what they have managed to cram on this circuit board. Towards the end of the video, I will suggest an upgrade if you plan to use it for full-time hosting. On the top right, we have a gigabit Ethernet port, which supports true gigabit Ethernet speeds. The Ethernet transceiver chip on the Raspberry Pi allows you to achieve full gigabit speeds of 1000 megabits per second, compared to the Raspberry Pi 3, which was limited to 300 megabits per second. Below the Ethernet port, we have two USB 3.0 ports and two USB 2.0 ports. On the side view, we can see the Ethernet port in the center and two USB 3.0 ports (which have blue inside) and two USB 2.0 ports (black) on the left. Below the Ethernet controller, we have the USB controller chip. On the previous Raspberry Pi 3, the Ethernet and USB controller were on the same chip, causing the limitation of 300 megabits per second on the gigabit Ethernet interface.
Now, that’s broken up into two separate chips, which allows for USB 3.0 and the true gigabit Ethernet port. So now, if we continue on our way around the board, here we have a four-pole stereo output jack, which is handy if you want to connect headphones or some other external speaker. To the left of that, we have a CSI camera port. This is something I’ve never actually used, but if you wanted to connect an external web camera, if you use this as a desktop replacement, that’s what that port could be used for. To the left of that, we have two micro HDMI ports, which means that this board does support dual displays, which again is impressive for something so small. If you only use a single monitor, then this board can support 4K at 60 frames per second. If you use the dual display option, it can support two monitors at 4K 30 frames per second. Now, to the left of the micro HDMI ports, we have a USBC port, and this is used to provide power to the Raspberry Pi. Now, returning to the top of the board, here we have a DSi display port, this is something I’ve never used. And, continuing up to the top left, we have a radio frequency shielded module that provides Dual Band Wi-Fi 2.4 and 5 gigahertz. It provides 802.11 BGN and AC along with Bluetooth 5.0 and Bluetooth LE. So, if you don’t have a nearby Ethernet port, you can still use the wireless adapter and have internet access. It’s also helpful if you use this as a desktop computer replacement; you can connect a Bluetooth keyboard and mouse to it. Above that, we have this black bar with 40 pins in it; this is a 40-pin GPIO header, you likely won’t be using this. And next to that, we have a grouping of four pins, and this is used for PoE. There’s an extra module you can purchase, which is a PoE hat, and what that allows you to do is use PoE with the Raspberry Pi. PoE stands for power over Ethernet, so what that does is, once you plug in the PoE hat to the Raspberry Pi, you can now plug in an Ethernet cable, and if your switch supports PoE, then that singular cable can provide both network connectivity and power to the Raspberry Pi, and you don’t need to use the USBC port to power it.
So, in the center, we have the “star of the show.” This is a 64-bit quad-core Arm Cortex A72 processor clocked at 1.5 gigahertz. This processor has been more than enough for small projects. To the right of the CPU, we have DDR4 SD RAM. This will vary in size depending on the Raspberry Pi purchased. This one has 4GB of RAM, but it can range from 2GB to 8GB. This concludes the top of the board.
Moving to the bottom, there’s one component to highlight: the Micro SD card slot. This is commonly used to store the OS and related files. To upgrade, the author suggests using an NVMe SSD instead of the Micro SD card. You’ll need an NVMe SSD and an enclosure to plug the SSD in, then connect it to the Raspberry Pi via USB. This author uses it for a Mastodon server on a Raspberry Pi. You’ll still need a Micro SD card for initial setup, but once that’s done, the OS and data will be stored on the NVMe SSD. The reason for this upgrade is that Micro SD cards can be unreliable with large amounts of reading and writing. If a modern SD card fails, it goes into read-only mode to protect data.
I actually experienced this twice when I was setting up my Mastodon server. I tried to use only a Micro SD card, but when I installed the ruby gems, which required a high number of reads and writes, the SD cards went into read-only mode and I could no longer use them. Since I upgraded to the M.2 SSD, I haven’t had any issues and it’s been running reliably. I’ll link both the enclosure and the NVMe SSD below if you’re interested in purchasing them. I bought both from Amazon, the bookstore run by Bezos. The enclosure cost me around $19 and the specific NVMe drive that I bought was $35. There are cheaper drives available, but I like Western Digital, so you can probably pick one up for $15 on the low end. Again, this isn’t a required upgrade, you can still just use the Micro SD card if you prefer, but for reliability’s sake, I would suggest making the upgrade. There were some comments on my last video that said you can get a used old laptop for cheaper. This is likely true, but I like the small form factor and low power consumption of the Raspberry Pi, so I stick with it. The self-hosting guides that I’ll have in the near future can be adapted to whatever hardware you have lying around, but I’ll be demonstrating and performing the installs on a Raspberry Pi. If you made it this far and are not tired of hearing me talk yet, the top video is one I think you’ll enjoy if you liked this one, and the bottom one was chosen for you by the YouTube algorithm.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
I am upgrading to the Pixel 7 and after nearly two years of using Graphene OS, I have decided to leave the stock Android OS installed on it. Let me be clear, I did not want to do this, but I figured in order to offer a fair comparison between stock Android OS and Graphene OS, I should probably test out the stock OS and see how it is. My first impression with stock Android OS is that it has a very friendly setup. It wants you to log into your accounts to sync your settings and it comes with a ton of popular apps installed, as well as the Google Play Store, installed by default. I am speaking objectively for someone new to the OS, not from a privacy or security perspective. The whole initial experience was very welcoming. To keep things equal in my testing, I am going to be using the Play Store on both OS’s by signing in so I can download apps. I also wanted to try and embrace the stock Android OS as much as possible to see if there were any features I might miss.
I am a simple person and my phone habits stick to that theme, so it’s likely I missed a bunch of features that these OS’s offer. With my time on stock Android OS, there are a few major things I noticed. The OS wants you to sign in a lot, which I guess is no surprise. You are always reminded to log in, sync, and use your Google account. I did my best to avoid this, even though I signed into the Google Play Store. I didn’t want to sync any of my phone data with my Google account. As far as navigation goes, I noticed that Google Maps is very helpful for traffic. As someone who lives in a busy city that I think has some of the worst drivers in the United States, Google Maps saved me time at least on three different occasions by helping me take a different route instead of the one that had multiple traffic accidents during rush hour. Now the biggest difference I noticed right off the bat, which I was not expecting, was Google Keyboard, otherwise known as Gboard. It makes the initial feeling of stock Android OS very fluid and cohesive. My typing felt more accurate while using it and I’ve heard people in the past suggest using a different keyboard from the stock one that comes with Graphene OS. Now, I can see why they suggested it. It really makes a big difference. The phone and clock apps on stock Android OS are very well designed as compared to the AOSP versions used on Graphene OS. While I didn’t use any of the extra features offered by the phone or clock app on stock Android OS, aesthetically, they are very nice looking.
In terms of functionality, the way I use them, there was no difference. There are two features on stock Android OS that are not available on Graphene OS. The first is Android Auto. The reason for that is that it requires system-level integration, and that is not something the project is willing to support, which I completely understand. The second feature that I found, which I really liked, is the now playing feature. Now playing listens to background audio in your environment and will show you the song that is now playing on the lock screen, if it can identify them. It does sound a little bit counter-intuitive from a privacy perspective, but I liked it. Now playing doesn’t send audio or background conversations to Google, according to their documentation, and all processing takes place locally on your device. I can already hear the people typing ’lies, Google’s collecting my audio and listening to my conversations.’ I’m going based off of the information available and documentation, not speculation. So with all that said, at the end of the day, I still did not like being on the stock OS. You are reminded that Google is there for your convenience, ready to save your passwords, collecting telemetry in the background, and the inability to uninstall a lot of the bundled apps. All you can do is disable them. There’s just something uncomfortable about knowing that Google services have system-level integration, and therefore do not follow the regular permission controls available for sandboxed apps. So after almost two weeks, I went and installed Graphene OS on my Pixel 7.
The first things I did to make it a fair comparison were to install sandboxed Google Play services, all of my apps, I installed the Google keyboard, and I set the same wallpaper. I was happy to be back. No annoying prompts to sign in, and I felt like my privacy was back under my control pretty quickly. I noticed some of the visible features that I missed that Graphene OS offers. Those features were the network permission, when you install an app, the sensor’s permission, and storage scopes. Stock Android OS does not have these features. If you want to learn more about those, I’ll link my video covering those down below, but overall, with the Play Store, Gboard, and a wallpaper set, the experience felt very familiar to stock Android OS. I honestly thought there would be a jarring difference when I switched back, but there wasn’t. A popular question I see is, ‘Am I getting any benefit to using Graphene OS with sandboxed Play Services installed?’ And the answer is yes. On Graphene OS, they are installed as sandboxed apps, like any other app you install. They have no access beyond what other apps can access, and you can set the permissions on the apps installed. This implementation provides a great balance of usability and privacy. Now, this was an oversimplified explanation. The official documentation goes over this in great detail and explains it very well. I’ll link that down below, and I do suggest you give it a read if you plan on using them or want to learn more. So, at the time of this recording, I’ve been using Graphene OS on my Pixel 7 for nearly two weeks, and I haven’t noticed any issues or bugs for my specific use cases. As far as battery life goes, I haven’t noticed much of a difference between the two OS’s. I feel that they are similar for the setup that I’m using, but I haven’t done any official tests for battery life. Now, the setup in this video isn’t how I’m going to leave my Pixel 7. I’ll be covering a new setup that I’m going to try in a future video, but if you have any hesitations about moving from stock Android OS to graphene Os from my basic phone usage habits with sandbox to play services installed I don’t think you’ll have much of an issue.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
They say the best option for privacy is to self host your own data and services. While I do agree the privacy benefits are hard to beat, there are some downsides that I don’t think are discussed enough. Before we get into it, I will be doing a self hosting series in the very near future using a Raspberry Pi, I settled on the Raspberry Pi Because it’s an affordable option for many people compared to purchasing a full fledged server. It’s low power nearly silent, since it’s fanless. And you can get one for between 35 and 100. US dollars, depending on where you buy them from. One of the main benefits of self hosting, especially as someone who talks a lot about privacy is that you own your data and have physical control over it. It’s not uploaded to the cloud encrypted on a server that a company may have access to, you are going to be responsible for it yourself on your own hardware, wherever you decide to plug it in and powered up. I think having that level of control can be liberating, while at the same time terrifying, your data will be stored on a little card like this. That means if you lose it, the card malfunctions, or there’s a natural disaster and it’s destroyed, and you didn’t take a backup or replicate it somewhere your data is gone. And that’s on you. There’s no large corporation ensuring its integrity, and that it’s stored in multiple geographic locations in case of catastrophic failure. Now, while that might sound a bit scary, there’s also something satisfying about knowing that if you want to destroy your data you can and it’s not stored somewhere that you were not aware of.
So as far as privacy goes, self hosting is a big win. Security. That’s a different story. For all intents and purposes, you will be a systems administrator, patches, updates, upgrades configurations, the security we all take for granted when we upload our data to a billion or trillion dollar company is now your responsibility. This goes back to where I mentioned that at least some part of you has to be okay with tinkering and troubleshooting. This won’t be a set it and forget it sort of thing, you’ll have to maintain it and take care of it. It also sounds like I’m talking about a pet. Modern day expectations are that services are available 24/7 365 As someone who has worked for a hosting company, I don’t think most people realize the level of effort and resources it takes to get five nines of uptime. When you self host you’re at the mercy of your internet service provider and Power Company. Maybe the power goes out for 10 seconds, which normally wouldn’t be a big deal. But now your server was powered off and you need to turn it on and login again. Maybe you had a battery backup so you’re good for short outages. But what if you live somewhere like Florida and the power’s out for weeks. I also heard that some ISPs have rules about hosting services out of your home, even if they are for personal use. I’ve never had any issues in the United States. But I don’t know how that works in other countries. An easy way to avoid some of the hardware power and internet failures I just mentioned would be to rent a VPS from a cloud provider. There are some pretty affordable ones out there. But for now on this channel, I’m going to focus on hosting out of your home.
With the doom and gloom out of the way. I’ll be doing various demonstrations in the coming months on configurations and services. If you have the money, I would suggest getting at least two Raspberry Pi’s with extra SD cards so that you can have one to mess around with and one to host your data. It’s also useful to have one as a backup in case your main one has a hardware issue. The goal of this was not to demotivate you. That’s the last thing I want, especially since I’ll be making videos on it in the near future. I just want to make sure that you’re aware of the added responsibility you’ll have before embarking on this.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
Maybe you’ve heard or maybe you haven’t, but there is ongoing drama in the crypto space. Not even necessarily drama, just mind-blowing behavior from Logan Paul to SPF with FTX. All of this has reminded me of a topic I’ve wanted to make a video on: NFTs are not what they seem. These are photos I printed on a Kodak printer at CVS, but they’re being sold as NFTs. There’s a big misconception that when you buy an NFT, you’re buying the artwork, but that’s not true. The blockchain only confirms that you own the NFT, not the artwork. I heard someone say before that when you buy an NFT, you’re just buying a URL, but I never looked into it further. So today, we’re going to look into what you actually get when you purchase an NFT. I would say NFTs are the low point of crypto, but then something else happens and we reach a new low.
This is OpenSea, an NFT marketplace, likely the most popular one out there. For our example, let’s search for a popular project such as Board AB Yacht Club. Here are the current NFTs that are up for sale. Let’s pick one of these as an example; they just get worse and worse the more you scroll. So let’s go with this one. On this page, if we scroll down and go to the details section, from here, we can see the contract that is actually tied to this NFT. Let’s go ahead and open this in a new tab. This takes us to Etherscan. On this page, we want to go to the contract. This is the actual code that the contract is comprised of. We want to go to read contract. And on this page, we want to look for a function called token URI. We can see here number 20, token URI. Inside of here, we want to take the token ID from open C 3559. Put that in that box. Select query. Now we are presented with a string that contains an IPFS address. IPFS stands for Interplanetary File System. If you’ve ever heard of BitTorrent and how it works, IPFS is similar. You have a network comprised of nodes, which are just individuals, servers, or companies running this IPFS software. These nodes can talk to one another. If you’re a node on the network and you request an IPFS URL, you’ll ask a nearby peer if they know who has this content. That peer will say yes, I know who does and provide the node with the content. It’s a decentralized way to store files and share information.
And that’s what we see here. This is the IPFS URL. You can’t just go there in your browser, it doesn’t work. So instead, we’re going to use an IPFS gateway. There are public ones available, a popular one is ipfs.io/ipfs. And then we follow that with the string that we found on etherscan.io. Now when we load this, the reply we get is JSON. And what we can see here is we have an image, with a URL that is tied to it, and then some metadata about the image. This is the data that is tied to the NFT that is purchased when it’s bought. And this is the image that you actually get. Again, it’s another IPFS URL. Now, if we go to this, we can see the image. The image is not actually on the blockchain, it’s not there for people to see. It’s just this JSON data that has the image URL that you can access on the interplanetary file system. Someone has that image hosted there, but it may not be there forever. Sometimes the image just disappears after the sale. You’re not purchasing any rights or anything like that. You’re just purchasing this JSON data that has some metadata attached to it, some attributes, and a pointer to a URL. As we saw here, this is going for over $100,000. All that you get is a record on the blockchain that says you purchased this.
To the defenders of NFTs, I know there are different ways to host these files that are more resilient and reliable. But that takes us back to the initial question of what you get when you buy an NFT. To me, this is much different from what I initially thought NFTs were and how they were marketed and promoted. So, this is not glamorous by any means. But I think the story we were told about NFTs is a lot more glamorous than what you’re actually getting. So, the moral of the story is, don’t pay six figures for some NFT that an influencer promoted so they can make a quick buck off their fan base.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
If you’ve been following my channel for any length of time, then you know that I use graphene OS on my mobile device. My browser of choice is the one that’s bundled with it, which has vanadium. In addition to being bundled with the OS, there are a few other reasons I really like it, which I’ll cover in today’s video on graphene OS vanadium is the user facing browser that’s included with the OS and the provider of web view, which is used by other apps to render content. Now you might be asking what is what view. So as an example, let’s take a look at mastodon. Now there’s a post on Mastodon with a link included with it. And I selected, we can see that the page was opened, but I wasn’t actually taken outside of the Mastadon app to my web browser. Instead, the app displayed the link using web view. So even though you might not think you’re using vanadium, if we select the three dots in the upper right-hand corner, we can see at the bottom running in vanadium. So, that’s what web view is, as the name implies, that lets you view the web vanadium is a chromium-based browser, which means it provides the strongest sandbox implementation available for browsers at this time. Among other security features like exploit protection and site isolation. Vanadium actually improves upon these features, so you get even more protection as compared to using the standard Chrome browser.
Another important feature is that by default, JavaScript JIT is disabled. I’m pretty sure it’s pronounced a JIT and not J. It just like iOS is not ios. But I could be wrong. While JIT is meant to improve performance on load times, it also increases your vulnerability to browser-based exploits. And an article by Microsoft, they noted that looking at CVE data after 2019 shows that roughly 45% of the CVE issued for V eight, which is Chrome’s JavaScript engine, were related to the JIT engine. So blocking JIT by default means that you greatly reduce your vulnerability to browser-based exploits. I hope to go into more detail in the future on topics like sandboxing, JIT and exploit mitigation. When I figured out a decent way to explain and demonstrate them, there was one feature I wish this browser had, and that is a built in ad blocker. The section on graphene os.org that discusses web browsing does mention that they have plans in the near future to add content filtering. Luckily, there are still two popular ways to block ads. The first is if you use a VPN, typically they have an option for ad blocking. This is done via DNS where they filter out any known ad domains. It’s not great, but it works. Another similar method, which uses the same DNS filtering technique is using the secure DNS option and vanadium and specifying a DNS server that filters ads, one that I like to use as the mullvad ad blocking DNS server, research any recommendations before blindly trusting a YouTube stranger? It’s what I like to use, but it might not be the best for you.
Besides adding the custom DNS server, there’s a couple other changes that I like to make under passwords. I don’t use medium for passwords, so I disabled that. Same under Payment Methods addresses, disable that as well. Under privacy and security. I disable autocomplete searches and URLs I’ve mentioned in the past, but I don’t like autocomplete in my browsers, I only want my data to be sent when I click Submit, I enable open External links and incognito. I like this feature. Let’s say your friend sends you a link and you click it. Instead of that link being opened in a normal tab. It’s now opened in an incognito tab, I leave Do Not Track enabled because it’s enabled by default, disabling it would just set you apart from the others using the default settings. And then the last option I change if we go back, I turn off the homepage. This is just personal preference. And then one other tip that I see some people have questions on it. Let’s say you want to use a different search engine such as start page, you don’t see it in the list here. What you need to do is first go to start page.com Once you get there, if you click Set as Default the instructions explain the steps, but what you need to do is go into the Start Page Settings, Settings. Scroll down to the section labeled HTTP request method. Change that to get save your settings confirm and now if we make a search and go back into our browser settings search engine. We now see recently visited start page we can select that and now when we run a search, we can see that start page is used by default.
If you use vanadium or thinking about using vanadium, check out the web browsing section on graphene os.org. It has a lot of great information
]]>
/usrPlease excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
GitHub is a hosting service for software projects. And on each GitHub project, there is a tab for issues, where users or the developers themselves can open up anything that might be an issue with the project. Not typically, the Issues tab has a place where useful discussions take place. And other times it’s a source of entertainment. So today, I’ll be sharing my five favorite GitHub issues that I found over the years. So let’s start with number five. The first issue is for a project called Neo fetch. It is a command line system information tool basically displays information about your system, the OS kernel uptime, the issue that was opened was titled at Neo fetch is not displaying the weight of my computer as a possible for Neo displaying the weight of my computer can see the comments and what ask your kitchen scale. So, I don’t know if this person was serious when they open this issue. But as you could expect from the internet, comical replies ensued. This is really good idea, weight and volume are always hard to measure would be really useful. One could see the current weight of their laptop, depending on the battery percentage. So reading the thread, there was actually some pretty decent suggestions besides the funny ones. Since they are scraping hardware information about the computer, someone suggested that once the hardware information was determined, they could scrape publicly available information for the weight of different components. Either way, that being said this was not implemented, but nevertheless, still pretty funny.
Coming in at number four is a project called the liftoff. Se CLI for creating and configuring new Xcode projects. This one’s a good reminder why recruiters should not chime in on GitHub issue threads. So if we take a look at the issue that was opened, it was added support for the new launch screen. xiv files. Okay, fair enough. You know, some regular discussion not convinced this should be the default. If we keep scrolling down, right at this point, there used to be some comments here that were deleted by the initial author. Thankfully, someone on the internet took some screenshots, we can see here a post from a recruiter, notice that you guys have been so active in iOS development would really like your input about this position I’m currently trying to fill the company is asking for iOS developers with a strong lamp background, we can see the first comment that came in by lamp background, do you mean writing flashlight app specifically? A little bit further down, I meant LAMP stack. If you don’t know what lamp stands for, it stands for Linux, Apache, MySQL, and PHP, which is a typical software stack or was a typical software stack that was used, just a quick way to refer to it. But obviously, the recruiter made a typo with lamp background, I wrote a really strong web flashlight app, I could probably port that to iOS. It really just took off pretty quick. We can see here the recruiter was a little bit salty about the comments. Oh, great, funny, but not really helpful. And then still posted the entire job description. But then a little bit further down and start getting pretty interesting. We have a stack of lamps, some more lamps, literal stack of lamps. You gotta love it when people give some additional context on images. The senior lamp developer above is mentoring the junior lamp, very touching. This is a funny one to read through. And as always, the links will be down below in the description in case you want to read through these threads yourself, which I suggest you do. They’re pretty entertaining. So what can we learn from this, if you’re a technical recruiter, you should probably stay out of the GitHub issues. Because if you make one mistake, you will be eaten alive by everyone else in there.
On to number three. This is for something called twine, which is utilities for interacting with pi pi. This one’s pretty straightforward. If we go to the issue, the individual said I had some trouble using twine to upload a package to testify pi i tried like this. They put the details what else happened? And then scrolling down a little bit further, we get a comment. Were you able to resolve the issue? And then the original poster said, No, I decided I don’t care. So not really much to it, but just the tone of the original person straightforward to the point. And you know, they didn’t figure it out because they don’t care. I feel like we can all learn something from this. Sometimes in life, there are tasks or problems that just aren’t worth it. So sometimes you need to decide that you just don’t care.
So moving on to number two actually had a pretty difficult time deciding on what should be first and second place. But ultimately, I decided on setting Bumblebee which is now old and abandon as second place. But if we go to the issue that occurred with this install script does RM dash RF slash user for Ubuntu? So if we go down to the details for this issue, I want you to note just how many reactions are on this and how many comments were actually left. So the initial report says an extra space at line 351. So if you’re familiar with Linux at all, RM what that is used for is removing or deleting files or folders. The our flag specified here that means a recursive and so if you have a folder inside have a folder. It’ll remove everything after that recursively and the F flag that stands for force. So that means you will not be prompted for any confirmation on what you want to remove in the mistake in the code was that there was this extra space here between slash user and slash lib. So instead of actually removing the X Org, at the end of the path here, since there was a file here, what happened instead is that the slash user directory was completely removed. When this was run. We can see here totally cool, dude, this script deletes everything under slash user, I just had to reinstall Linux on my PC to recover. So yes, one single space caused quite a bit of issue. And if we see the response from the developer, well, first we have another person who yes, this happened to me as well. developer on the project, fixed it. And then the comment, giant bug causing slash user to be deleted. So sorry, if we scroll down a little bit further, we get some more information on why this mistake was made. Yeah, I was very tired that night. And then there’s some comments. This is from the initial person that reported it. Get some good humor laughing about it. Poor guy. Nice. You’re famous. So I like this one, especially give this man a round of applause. His styling caused the Linux to commit die. This is the power of Linux, this whole issue actually reminds me of this meme. Hey, can I uninstall edge? No, you’ll break your system. I’m going to uninstall the bootloader, your system will break sudo. I’m going to uninstall the bootloader. Go ahead. Gotta love the power of Linux and what it will let you do.
Now that brings us to number one, which I think is well timed for this time of the year, as you will see why shortly. This is for Visual Studio Code, which is a popular source code editor by Microsoft, the issue that we’re looking at is a blend of humor and drama to each their own in their own opinions. But this was for Santa hat on vs. Code insiders and pushing a religion is very offensive to me. So yes, this you can read over what’s going on here. If we scroll down further. The issue was, is that on VS code, they added a Santa hat to the settings logo. And this was not taken kindly by some people. Apparently, the developers actually removed it very quickly. But then what ensued was a storm of comments on this related issue. There were more comments on the original issue in the past, but they’d been deleted at this point. The linked issue is the actual response from the Microsoft team. I’m pretty sure this turned into a rather large PR nightmare for them. They even had the lock the repository. This one always makes me laugh, because I don’t think I’ve ever seen such a detailed response from Microsoft on anything. They went into quite a bit of detail. They even added updates because of the response. They got the background. What happened gave more details on the situation. This one got out of control for them real quick from a very simple change. But if you’re looking for a thread full of humor and drama, then I think this one would make for a good read. There’s a lot going on here. Probably my favorite comments on this issue was where someone took Octocat, which is the GitHub logo, put a Santa hat on it and a dreidel in its hand. I don’t really have much more to say about this issue, as I don’t want to get into this topic on my YouTube channel. Either way, still a piece of history to me at least that wraps up the list and this year, so merry Christmas, happy Hanukkah, happy Kwanzaa. Happy Holidays and Happy New Year.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So I’m going to be brave here and to share with you my brave browser settings. Before that, I want to make a quick disclaimer, there is some benefit that comes with just using the default settings the browser comes with, you blend in with all the other default installs instead of using a customized browser. Brave is what I’m using right now on my desktop. On my mobile, I’m using vanadium. Privacy and security are always changing. So what you see now will likely evolve over time and change. But this is what works well for me at the time of this recording. In the past, I used Safari on Googled chromium, chromium, Firefox with a bunch of add ons. So take it with a grain of salt, always do your own research and use my advice as a starting point to figure out what’s best for you. And then lastly, as far as security goes, Chromium is more secure than Firefox at this time, which is why I’m using brave a chromium based browser. The only time I use Firefox is when I’m using Tor browser. So for this demonstration, I’ll be using a fresh install of brave on Windows 11. So once you first install brave, you’ll see this screen, I’m going to just click Skip welcome tour, you’re presented with this busy dashboard. And the first thing we’re going to do to start our customization, click the three bars in the upper right hand corner and go into settings. If you already have brave installed on your computer, you can just follow along and go into the settings. So on the first section getting started, I just leave all this set to the default, I don’t change anything here, you can make brave your default browser if you want.
Next on to appearance. And this one, I like to disable the show side panel button. The side panel is this, I don’t use this reading list at all. So I disabled it. We can then scroll down. I like to enable this setting always show full URLs. And so what that means is you’ll always see the full URL in the address bar when you’re visiting a website, you won’t see an abbreviated version. And that’s the last setting I change on appearance on to New Tab page. So this busy dashboard, we see on a new tab that we saw at the start, I don’t care for this. So in the settings, what I do is I change that to blank page. The dashboard is disabled the settings for it. And now if we open a new tab, we just see this. So again, that’s just preference. I don’t like the busyness of it. So that’s up to you. So on the next setting shields. So on this page, I leave all these the default trackers and ads blocking, you have a couple options here. You can either leave it standard or change it to aggressive. Personally, I leave it on standard. If you change it to aggressive, you might break some site functionality. But again tested out up to you block scripts, if you enable this you will break sites. So I leave it disabled block fingerprinting, this also has a strict may break sites option. To me the jury’s still out on whether or not blocking fingerprinting actually works or if it just makes you more noticeable. I haven’t done much research into exactly what brave does to block fingerprinting. So I just leave it on standard block cookies only cross site. If you block all cookies, again, you’ll break functionality, so I leave it on only cross site. Next is brave rewards. I don’t enable this, I don’t use brave rewards at all. So I like to disable the option in the menu bar. So now we can see that’s gone. Now on to social media blocking, if you use Google or Facebook to log into any third party sites, then you want to leave these enabled. Me personally, I don’t use Google or Facebook to log into any third party sites. So I just disabled these. And the last setting on here allowed Twitter embedded tweets. So if you ever reading a news article, and you see an embedded tweet on there, if you disable this, that tweet will be blocked and you won’t see it. So if you’d like seeing the tweets, leave it enabled if you don’t disable it on to privacy and security.
The first setting autocomplete searches in URLs, I always make sure this is disabled. When you enable this, it starts sending the data as soon as you start typing in the search box. So if you accidentally type something personal, that data is already sent off without you actually even submitting the search. So I always make sure this is disabled so that my searches are only sent when I press enter. The next setting is WebRTC IP handling policy. And click here to learn more. So we can see here the default WebRTC has the right to enumerate all interfaces and bind them to discover public interfaces. That is not a great default setting. The one we’re going to change it to is disabled, non proxied UDP, and I’ll show you why in a moment. So if we go and search for WebRTC leak test, I’m just going to click the first one. So depending on your home network setup, but WebRTC has the ability to potentially leak your real IP address, even if you’re using a VPN service. I’ll leave some more links down below in the description. So you can read more about WebRTC if you want to. I’m not going to cover all the details about it in this video. But in our browser, we’re going to change this from default to this able nonpracticing UDP. Now if we go back here and refresh the page, we can see web RTC is disabled and will not leak your IP address. So that’s just an example of why we want to change that from the default setting, I would suggest reading more about WebRTC, which stands for web real time communication. It’s mostly used for video chat and different things like that. But changing it to this setting will reduce our exposure. Further down, we have allow privacy preserving product analytics, disable, automatically send daily usage ping to brave, disable, I leave the clear browsing data set to default like only Claire manually, but if you want, you can set it up so that on exit your data is cleared. Cookies, I’ll leave this on default. But we are going to click on security. So now Safe Browsing from what I understand is that it takes a hash of your URL that you’re visiting, and compares it against a hash of malicious urls to make sure that you’re not visiting a malicious site. If you are it’ll warn, you know, I don’t want to install a new build. Different browsers implement this in different ways I wrote about how brave does it I’ll link that down below. It sounds like their implementation is better than how Google Chrome doesn’t. But I’m still not the biggest fan of it. So for me, I disable it, even though that’s not recommended. But I would suggest you read about it, the pros and cons of it, how it works, and then make that determination for yourself and what’s best for you. And the last setting I like to enable on this page is always use secure connections. And what that does is if you browse to a site over HTTP, and for some reason, the website doesn’t automatically redirect you to HTTPS, brave will handle that for you, and redirect you automatically. And if for some reason the site doesn’t support HTTPS, it’ll warn you before loading sites that don’t support it. So that’s the last option I change on this page. So we can scroll back up, go back. And on the same page, we’re now going to go into site and shield settings. So these next settings will be personal to you and how you use your browser. So under permissions. For me personally, I never use location in my browser. So I’m going to click on location. And then I’m going to select don’t allow sites to see your location. So instead of a site showing a pop up asking if they can see your location, I like to disable that completely. So I don’t even see the pop up, we can then go back. And the rest of these I’m going to leave enabled, I use video chatting in my browser. So I need to use the microphone and camera for that. If you don’t go ahead and disable those notifications, if you don’t like them, disable them. Then everything else on this page, I just leave set to the default screen, scroll up again, go back.
The last thing I like to disable is this private window with Tor. If I want to use Tor, I just use the Tor Browser. I don’t want brave handling that at all. So I like to disable that functionality. So that’s all on this page. Next is sync, I don’t use sync search engine. So this is personal preference. There’s a bunch of options here. So I’ve been using brave search for a while and it’s been working well. Sometimes I use start page or DuckDuckGo haven’t really had a chance yet to settle on one. And then sometimes if I’m looking for something specific, that’s technical, I’ll actually use Google because sometimes I get better results there. I know I’m a fraud. But that’s what works for me. And then on to extensions, I disabled the Hangouts option. This next one about unstoppable domains. I just disabled This, along with the method to resolve the Ethereum Name Service. I also disabled this, if you use either of these, you should probably leave this setting enabled. If you don’t like me, then you can probably disable them. Web torrent, I disabled this one I don’t want my browser opening torrent files or magnet links the setting here for Widevine if you use any streaming sites such as Netflix or Amazon Prime video, you’ll likely have to enable this. Otherwise the content will not play in your browser. For me, I don’t use those so I just leave it disabled. So there’s nothing else will be changing on this page. So next we can go on to Wallet. So brave also has support for cryptocurrency wallets. I don’t use it. So I just disable all these seven to none. So since I don’t use the wallet feature in Brave, I don’t need the icon in the toolbar. So I disabled that. On to IPFS IPFS stands for interplanetary file system. They have some links here if you want to learn more about it, you can click and read. I don’t use it at all. So I set it to disabled next week and go on to autofill so if you’ve seen any of my previous videos, you might know that I use one password I’m still in the process of testing out and migrating to bit Warden But with all that being said I don’t use any browser Password Manager. So I like to go into the settings and disable that. Let’s go back. So besides passwords I don’t let brave store my payment methods solely To disable this as well,
I can go back. And the last one addresses, I don’t let brave store my addresses either. Disable that, go back onto languages, I don’t like to use brave translate. If I want to translate something, I’ll just paste it into a website to translate it. So I disabled that on to downloads, I just leave this set to default help tips. So this setting is actually pretty cool show Wayback Machine prompt on four or four pages. So if you get a 404 and a web page, which means Page Not Found brave will give you the option to go to the Wayback Machine and see if there’s a cached copy of the page there. So that can be pretty handy. So I just leave that enabled on to system. I don’t like this continue running background apps on Brave is closed. So I disabled that. And that is the last browser setting that I change. So as far as additional extensions go, I do use the one password extension. I also use something called bypass paywalls. It’s on GitHub, and it does exactly what it’s named. But besides those, that’s it I try to keep my browser as stock as possible and not loaded down with extensions. Most people think the more privacy extensions you had, the better but really, you’re just making yourself more unique compared to someone who’s using a default setup. So again, this is what works for me now. I hope we can help get you started in your own research and testing. As this was a browser preference video. I’m sure there will be some feedback. So if you have any feel free to let me know down below in the comments.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
If you’ve ever explored the privacy settings in your browser, you’ve likely come across a setting related to do not track. Let’s talk about what this is. I’ll show you exactly what the setting does. And then we’ll talk about how Microsoft killed it. DNT or do not track was proposed by the EFF in 2009. It will be implemented by your browser is sending an additional header to the website that you are visiting, indicating that you wished not to be tracked. The W3C standard for DNT explicitly stated that it’s only used when the user made a deliberate choice to enable it. While this feature had the best of intentions, some early studies indicated that it was largely being ignored by the trucking industry. Before we continue, let’s take a look at exactly how DNT works.
So, here I am on my website site of burritos.com. I currently have the Do Not Track setting enabled in my browser. If we right-click, go to inspect, go to the Network tab, and then refresh the website. We’re going to select the initial request. And if we scroll down to the section labeled request headers, we can see a header here called the DN T with a value of one. So, when you have this setting enabled in your browser, your browser will then send the DNT header on all requests indicating that you have it enabled. Now if I disable the Do Not Track setting and go back to the same page, we were just on, refresh the page again. Click on the newest request, scroll down to the request headers, and we no longer see that d and t header 13 years later in 2022. This feature is actually having the opposite effect of what it originally intended. So, since so few users have this feature enabled, and it’s making little to no difference in preventing tracking, companies and marketers are using the DNT header we saw in the demonstration as another way to track visitors. So instead of helping you, it’s hurting you by actually creating an additional data point that can be used to fingerprint you.
The last reason not to use it is that Microsoft killed it. As I mentioned, the W3C standard stated that this feature had to be a deliberate choice by the user. In 2012. Internet Explorer 10 was released with DNT enabled by default, which violated the standard and gave the tracking industry a reason to officially ignore it, since it could no longer be assumed the user enabled the feature. In May 2014. Yahoo announced they would stop supporting the Do Not Track privacy header. And in the years following, Google, Facebook and Twitter made similar announcements. More recently, in 2019, Apple removed the DN T feature from their Safari browser completely. I remember when this feature was originally announced, and I was pretty excited we were finally making some progress in terms of user privacy. As we can see, now the feature is dead, and it can actually cause more harm than good. So make sure you don’t have it enabled in your browser. And if you do, I would suggest disabling, and I’ll leave links down below in the description and how you can verify in popular browsers whether or not you have this setting enabled.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet. βοΈ
I’ll be the first to admit, whenever I see some slick looking minimalistic dumb phone, video thumbnail or a title with “I use the flip phone for 30 days,” I click it. And why you may ask? Because I’m tempted to try one. From a design aspect, the minimalist phone gets a nine out of 10. The Flip Phone usually doesn’t look as great, but they are minimal.
But for both of those options, it’s downhill pretty quick from their functionality, usability, and hardware. They are all lacking. But the biggest downside for me as someone who has a tech background is the lack of security and privacy on these phones. These devices all have some random custom OS specifically designed for aesthetics. From an OS perspective, they’re insecure. From an app perspective, it’s no surprise that it’s also minimal. And usually the only form of communication you have is standard phone call and SMS, which are both unencrypted and not secure.
So what are you really getting for your money? Once you dig a little bit deeper and get past the good looks, you end up with a device that in all honesty, nobody should be using. So what options are you left with? Do you use an iPhone with the color turned off, so you’re less tempted to use it, or maybe a stock android phone with all the apps uninstalled? Both of those are not great from a privacy perspective. And they both take quite a bit of customization to actually get what you’re looking for. And so for me, neither of those are great options.
That brings us to something called a Graphene OS. It’s a private and secure mobile operating system with Android app compatibility. And this is what it looks like. Minimal, clean, simplistic, and most importantly, private and secure.
This in and of itself as a minimal phone, you can see the apps that it comes with just the basics to get you started and have a functioning device. You can make phone calls, receive text messages, you have a browser, calculator, alarm, nothing extra unless you choose to add it. And so I’m a fan of the default interface.
If you want that aesthetically pleasing, minimalistic phone looking interface, there’s something called On Launcher. On Launcher is a free launcher you can install on your Android device. In this case, my Google Pixel six a running Graphene OS. So once you install it and set it as your default launcher, this is the interface that you are now presented with. At the bottom left, we have access to our phone. At the bottom right, we have access to the camera. In the center, we have settings. And if you swipe up, no colors or fanciness, drawing you in, just a simple list of your apps in a functional interface.
So now that we have our secure and private device with our simple interface configured, there is one last app we want to install. And since this is an Android device, it is compatible with Android apps. And that last step is Signal. What that’s going to provide us with is a secure and private means of communication. If you’ve never used it before, it has text, audio, and video chat available. I have a friend using a setup very similar to this.
He’s been using it for over six months and at this point, he said there’s no going back. So, if you’re interested in getting a similar setup for yourself, graphene OS supports the Google Pixel. So, if you have one of those, install on launcher and signal, all of which will be linked down below. And at that point, you will then have a secure, private, and minimalistic phone that will make you not hate your life.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So in today’s video, I’ll be demonstrating how to install graphene iOS on the Google Pixel seven specifically, but if you have a different Google Pixel, this process will be relatively similar, I’m going to be using the web installer. And if you use that, it’s nearly impossible to mess up your phone. So don’t be afraid to attempt this. Now with that being said, there are a few hiccups you may run into during the install process. And I’ll cover those at the relevant points in the video. The computer I’m demonstrating this from is running Mac OS, and I’m using the brave browser. So to get started, we’re going to head on over to Griffin os.org. All websites that I mentioned in the video will be linked down below in the description box. So once you get here, click on Install Griffin OS. As I mentioned, we’re going to be using the web based installer. So once you get to this page, we’re going to scroll down to the prerequisites, give this a read through make sure that you have all of these requirements met. Make sure you’re using one of the supported OSS, like I said, I’ll be installing from macOS. So besides a supported operating system, make sure you are using a supported browser. There is an important note here, if you are using chromium on Ubuntu, it’s broken and will not work. So use a different browser, such as Google Chrome. Another important note here do not use incognito or private browsing mode. And so once you give that a read through, I’m not going to waste your time by reading it to you, and you make sure that all the prerequisites are met, we can then proceed on to the first step, which is enabling OEM unlocking in the screen we’re currently on is the screen that you’ll see if you just bought it brand new and just took it out of the box. So first, I’m going to walk through the initial setup. If you’re already past this part, you can skip it, I’ll leave the timestamps down below in the play bar. So we’re going to go ahead and select to get started. I’m not going to connect to a mobile network, I don’t have a SIM card in my phone. Skip. I’m going to skip connecting to Wi Fi select Setup offline, continue. Date and time, you can leave that set to default. You don’t need to uncheck these but I like to anyways click Accept limited warranty. Next additional legal terms except we are going to be erasing the phone so you don’t really need to set a pin but I think it’s good practice anyways
confirm the pin fingerprint unlock I’m going to skip this because like I said, we’re just gonna be erasing the phone momentarily. No banks face on luck, no thanks. This is just a quick tutorial on swipe navigation. If you want, you can go through it. Otherwise skip. So we have finished the initial setup offline and go ahead and swipe up. And we’re now at the home screen. So I’m recording this part while editing the video because I forgot to mention it initially, this step is not required. But it is suggested that you update your device before installing graphene allow us to check for updates, first connect to Wi Fi, then swipe up, go into settings, scroll down, tap on system. And then tap system update. If you see your system is up to date, then you’re good to go. Otherwise, install any pending updates and then continue with the video. So to enable OEM unlocking we first need to enable developer options, which you can do by going to settings about and repeatedly pressing the build number menu entry. And just one note before we actually start following the instructions, make sure you always go to the source when you’re looking for information. Don’t just follow some random YouTuber or some blog post, always go to the official documentation in this case graphene os.org get your information from the source first and then go from there. Select the instruction said we’re going to swipe up, go into settings, scroll down to the bottom, we’re going to tap about phone, scroll to the bottom. And down here we have build number. Go ahead and tap that until you are prompted for your PIN. If you set one, enter your PIN. And we can now see you are now a developer. So another developer options are enabled. Next go into Settings System developer options and toggle the OEM unlocking setting. So we’re going to go back, scroll down, go to system. At the bottom, we have developer options, tap that. If we scroll down, we can see here OEM unlocking so there is one caveat about OEM unlocking that I want to mention. So if you purchased your phone brand new from Google or from a store, you will need to connect to the internet first so that your phone can check if the serial number was sold carrier locked or if you’re able to enable OEM unlocking devices that are typically locked by the carrier or Verizon based devices, those ones even if you connect to the internet, you won’t be able to unlock. Your only option at that point is to either return the device or sell it and buy a factory unlocked device. For me personally, I usually buy my devices directly from Google, I select the unlocked version option. And every time I’ve had no issues, so if you’re watching this video and haven’t purchased a device yet, and you’re looking to buy a used mobile phone, I suggest asking the seller to send you a screenshot or a photo showing that OEM unlocking is available. That’s the only way to truly guarantee it. I’ve purchased a device used in the past, and it was carrier unlocked, which means I could connect to different carriers, but it didn’t actually support OEM unlocking so reach out to the seller to confirm that if they’re not willing to send you a photo showing that I would suggest not buying that device. So again, if you bought a new phone, you connected the internet OEM unlocking should be available at that point. And once it is, go ahead and enable OEM unlocking, you’ll be prompted for your pin again. Allow OEM unlocking, enable, and we can now see OEM unlocking is enabled. So on to the next step flashing as non root. This is for anyone who’s on Linux, I’m not on Linux. So I’m not going to cover this. But if you are give this a read over following that is booting into the bootloader interface, you need to boot your phone into the bootloader interface. To do this, you need to hold the Volume Down button while the phone boots, the easiest way is to reboot your phone and begin holding the Volume Down button until it boots up into the bootloader interface. So this part can be a little bit tricky for some people. So we’re going to swipe down, swipe down again, you’ll see down here the power button, select that, and then select Restart. Once restarting disappears from the screen, hold the Volume Down button.
This will take a minute. And if you were successful on booting into the bootloader interface, you will see this screen. If you were not successful, your phone will just boot up as normal. At that point restarted again, hold the Volume Down button until you get into this interface. So the next step is connecting the phone. If you’re on Linux, here’s a note about that. If you’re on Windows, you need to install the driver for fast boot if you don’t already have it, there’s a couple options for actually obtaining the drivers. So pause the video and Give this a read over if you’re on Windows. And for everyone else, we can just go ahead and connect our USB cable to our device. So this is where a lot of people run into an issue. They plug their phone into the computer with a USB cable, and their computer doesn’t actually see the phone and they don’t understand what’s going on. Typically that’s due to a faulty USB cable. The best option in this scenario is to use the stock cable that came with your device. If you don’t have that use a third party cable. But if you plug in your phone to the computer with a USB cable, and it doesn’t see it, try a different cable. Typically it’s a faulty cable causing you issues. One other thing to mention, make sure you’re plugging your USB cable directly into your computer, don’t plug it into a dongle first. That can also be the cause of issues. So again, use the cable that came with your device, plug it directly into your computer, and you should have the best chance of not having an issue. So plugging the cable to your device. So before we unlock the bootloader it’s important to note that once you do, all data on your device will be wiped. So if you were using your phone and you took some photos, or maybe this was your primary device and now you want to test out graphene iOS, make sure you make a backup of everything on there, your contacts, calendar events, text messages, everything will be erased and there’s no way to recover it. So once you confirm you have everything’s backed up or saved that you want, you can then proceed to unlock the bootloader select unlock bootloader and if your cables not faulty and your computer sees your device, you will see a prompt like this graphene os.org wants to connect, you should see your device listed here. Select Connect, we can see the screen changed, we have a quick disclaimer down here about unlocking the bootloader. And up here we can see it do not unlock the bootloader we want to unlock the bootloader. So to change the selection, we’re going to press the volume down or up. You’ll now see it says unlock the bootloader once you see that to select that option, press the Power button. And if you were successful at unlocking the bootloader you’ll see device state has now changed to red unlocked. So now that the bootloader is unlocked, we can proceed on to the next step which is obtaining factory images. We’re going to select Download release. And the actual amount of time this takes to download will vary depending on your internet speed. It’s gonna take a minute, two minutes or an hour. And so while that’s downloading, I just want to mention to consider donating to the project if you’re getting any sort of value from it, the developers putting in a lot of work to updates and Supporting new phones as they come out. My favorite way to contribute is using GitHub sponsors, it lets me schedule a monthly recurring donation to them. So again, consider donating to the project donations are used for paying developers purchasing hardware paying for infrastructure. So once the download has finished, it’ll say downloaded and the progress bar will be full. So now that the download has completed, we can proceed on with flashing our device, the initial install will be performed by flashing the factory images. This will replace the existing OS installation and wipe all the existing data, give this paragraph or read over. But the most important part is avoid interacting with the device until the flashing script is finished. So once we click flash release, just leave your device alone, don’t touch it, wait for it to complete. Once you’re ready, select flash release, you’ll see the screen changes. And again, just let the device do its thing. Don’t interact with it at all.
And so while that’s flashing I just want to mention that I have a somewhat monthly newsletter that I send out, you can sign up for that at site of burritos.com. If you’re new to privacy and security on your mobile device, I have a page on my website that has an index of all my videos I have. It’s a good starting point if you want to get familiar with what options are out there.
And then while we wait for this to complete, one of my friends came to me the other day upset about something they did, I told them some solid life advice, and that was that they needed to embrace their mistakes. So they gave me a hug
so once the flashing has completed, you’ll see the text on the screen has changed to flashed, and our phone is back at the bootloader interface. The next step and this is extremely important is to actually lock the bootloader give this a read over it explains why it’s so important. But again, to do that, we’re going to select Lock bootloader we see the prompt on our screen again, we see it says do not lock the bootloader same as earlier we’re going to press the volume up or down until it says lock the bootloader at that point, press the Power button
and if that completes successfully, we’ll see device state now says locked and it is green. Congratulations. You’ve now successfully installed graphene OS and can boot it. pressing the power button with the default start option selected in the bootloader interface will boot the OS. So if you have the default option selected, it should say start press the power button
you’re going to see the screen here devices loading a different operating system. Since we have a nonstock operating system installed, the screen is normal so expect to see that it’s also normal to see the Google splash screen. And at this point you’ll now see the graphene OS boot animation we’ll take a minute for the initial boot we can now walk through the initial setup. Select Start, select your language Next, set your timezone. Next I’m going to skip connecting to Wi Fi for now skip I don’t have a SIM card in my device but you can put one in if you want. Next, I’m going to disable location services for now. Next fingerprint you can set this up if you want to.
I do suggest setting a PIN code at the very least then please set something else besides 12345. Once you type that in and again press confirm if you had a backup from an existing graphene OS installation, you can restore it now. Otherwise, if this is a new installation for you, press skip
and then start so back on the webpage disabling OEM unlocking OEM unlocking can be disabled again in the developer settings menu within the operating system after booting it up again. After disabling OEM unlocking we recommend disabling developer options for a device that’s not being used for app or OS development. So we’re going to follow the same steps We did it when we initially enabled OEM unlocking, we’re going to go into settings, scroll to the bottom, select About phone, go to the bottom, tap build number to be prompted for your PIN code. You are now a developer, select back, go into System developer options. We can see here OEM unlocking is enabled, we want to disable that, please restart the device to enable device protection feature. So we’re going to do that in a moment. And then again, we want to disable developer options. So on select that, you need to restart your device to change this setting. Tap Restart. Now on the boot screen, I’m going to press my power button. When that initial warning shows up, tell you why in a second.
So pressing the power button pauses the boot. And the reason for that is down below here, we can verify the boot key hash. And so what you want to do depending on the device you have, if it’s a pixel six or newer, you want to look at this screen. In my case, I’m on the pixel seven. And I want to verify that this string matches what is displayed on my device. So take a minute to do that. Looking at it, I can see it does match. The reason as to why is listed here. So give that a read over. And so once you confirm that, press the Power button again to resume the boot. So at this point, you have successfully installed graphene OS and you can start using it if you like. But if you are new and looking for the simplest way to get started, I want to quickly cover that one feature of graphene OS is they offer sandbox Google Play services on stock Android OS plays services are installed in a way where they bypass the app sandbox and receive a massive amount of highly privileged access. On Griffin OS Play services can be installed as standard apps with no special access or privileges. So if you’re new and looking for the simplest way to get started, this is what I recommend. And that’s what I will be demonstrating. There’s a couple other options if you want a bit more privacy, such as installing them in a separate user profile. And I cover that in a video which I will link down below. But if you’re at all hesitant about this switch, and using graphene OS, then I suggest installing them as I’m about to demonstrate. Once you get more comfortable, you can watch my other videos or check out different blog posts on some ways to enhance your privacy and security. But for now, take the simplest approach get comfortable and go from there. So the first thing we need to do to install sandbox Play services is connected to Wi Fi. So I’m going to swipe down, select Internet, I’m going to select my Wi Fi network. Once you’ve successfully connected to your Wi Fi, we’re going to swipe up, select the Apps app. We’re going to go to Google Play Store, select that, as we can see here, it’s also going to install a Google services framework and Google Play services. Select Install all it’s going to take about five minutes to complete, I will be linking this down below, I do suggest you take the time to read it over, as well as the usage guide that’s linked at the bottom. There’s a lot of great information in here. It explains how it works, the actual configuration, limitations, things like that. So take the time read it over. There’s a lot of good stuff. So once that’s completed, you’ll see down here and now says open instead of installing. I’m just going to swipe up. We’re going to swipe up again, go into our app drawer. And you’ll now see Play Store listed here. So this will function just like Play Store on stock Android OS, you can select that sign in. If you’re looking for a little more privacy, create a separate Google account that you just use on here to download apps and things like that. Go ahead and sign in, download your apps, get yourself started. And then like I said at that point once you’re comfortable, check out some of my other videos or different options that are available. On my last piece of advice, privacy and security. It’s a journey. Don’t try and do everything at once. If you change too much, it’ll be hard to keep the habit so take it step by step. Do what you can and every little bit helps.
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So let’s talk about mastodon. There’s a lot of videos out there on why you should sign up for Mastodon, but I thought I would make a video on what it is a step by step guide with a live demo on how to sign up some basic usage, importing your Twitter followers and how to log into the mobile app. It’s also important to realize that you shouldn’t see Mastodon as a direct replacement for Twitter, or wonder if it can replace Twitter. It’s a different platform, it’s going to be a different community. So I suggest just checking it out, giving it a try seeing what you think, and kind of going from there. So before we go into the step by step of how to sign up for an account on Mastodon, I want to first talk about what it is and what it means to be a federated service. If you already understand the basics of Mastodon, you can skip this part, I will have the timestamps in the play bar below. So Mastodon is a federated service, which means it’s a group of servers hosted by individuals, even you could host your own if you wanted, and they’re federated together, which means they have a common communication protocol, which lets each individual server interact with one another. To understand that a little bit better. Let’s take a look at some pictures. So the first example is what a non federated service looks like. So if you, the user want to sign up for twitter.com, you go to the one location of Twitter, which is twitter.com. users sign up and they interact with each other on that platform. Another example is Facebook. If you want to sign up for Facebook, you go to facebook.com, sign up with an account, and you interact with users on that platform. But for all intents and purposes, these two platforms operate independent of one another. If you’re searching for something on Twitter, if you’re posting to Twitter, you’re not going to be interacting with anyone on Facebook, there’s a hard line between the platforms, they are run by a singular organization. There’s no Twitter to Twitter, three, Facebook to you sign up on one platform, it’s all centralized. And all content and interaction happens on that singular instance. So again, this is an example of a non federated centralized service. So now before we talk about Mastodon, let’s talk about another federated service that you are most likely already using, but did not realize it. So email is a federated service, you can sign up on different providers, whether that’s Yahoo, AOL, Gmail, proton mail. And so even though you signed up for your email address on these individual platforms, someone on proton mail can send an email to someone on Gmail, and vice versa. These platforms are all independently operated, but they use a common protocol, which lets them communicate with one another, which is why email is considered federated. Another example would be cell phone service, you can call another number that’s on another carrier, T Mobile AT and T you could even call someone from the United States to someone in Europe and communicate. They’re all operated by individual companies. But they use an agreed upon standard which lets them communicate with one another scenario that we saw an example of a non federated service, a federated service, such as email, let’s talk about Mastodon specifically. So Mastodon is not a centralized service. It is Foss, or free and open source software that is run on different servers operated by different individuals or groups on what are referred to as instances. So what you have here is you’ll have someone hosting a mastodon instance, you have other individuals or groups again, hosting the same software running on their server that they control. And then what makes Mastodon a federated service is that each of these instances that are operated by different groups or individuals use an agreed upon protocol that allows them to communicate and interact with one another. So as you’ll see, shortly, when we sign up for an account, we’re going to pick a specific instance where we sign up with our account. So for example, let’s say we sign up for an account on Tiger since Mastodon is a federated service. Even though we just signed up on this singular instance, we will be able to communicate with anyone on a different instance. So you sign up on Tiger, you can still talk with someone on lizard or fish, they’ll be able to search for you and your content, they’ll be able to see your posts, but this is mostly so you can get the basic understanding that it is a decentralized service comprised of different instances run by individuals and groups that can all talk with one another. No singular organization controls the mastodon network. It’s a group of instances that can communicate with one another that creates the federated network. So that was a basic overview of Mastodon and how a federated network operates. If that just made it more confusing, don’t worry, the actual signup might make things a little bit clearer once you can see it. So the first step for actually signing up for a mastodon account is to head on over to join mastodon.org. As always, links will be down below in the description. Once you get here, we’re going to select Create Account. And so like I mentioned in the example, we’re going to have a bunch of instances that we can select from ritually sign up for our account. And so the reason we’re going to join mastodon.org to find a server is that while this isn’t a list of all servers that are out there, it’s a list of servers that have committed to the mastodon covenant, which is a good starting point. Like I said, these servers are operated by individuals or small organizations, which means that those individuals or groups control the content that can appear on there as well. As how those servers are run, such as backups and different things like that. So at the bare minimum, at least know the servers listed here committed to the following four items, which is a good starting point. And just because you don’t see a server listed here doesn’t mean it’s bad. It just means that the operator did not submit their server to be indexed here. So the instance you choose is kind of like selecting your local bar or pub that you might frequent. And once you get in there, you can still communicate with everyone else, it’s just that that location you selected is your entry point into the network. Let’s say that your Pub is located in North America. And you want to find one that has the same interest as you so that when you enter there, first UC people that like to talk about the same things. In my case, North America, I like technology, some locations might require you to apply for an account. But for the sake of this example, I want an instant account. And so now we’re looking at instances that are legally based in North America with the topic of technology that have instant sign up. So I’m just going to pick this IOC data exchange. But regardless of what I initially choose, I can still interact with anyone on the mastodon network. And one more thing before we sign up, if you’re like me and afraid of commitment, do not worry, you can sign up for an instance. And if for some reason you don’t like the people that are on there, you can always migrate and switch to a different one at a later time. So take your time look around to try out different instances until you find one that you’d like. So to actually sign up, we’re going to click Create Account. And we are now taken to the homepage for this instance, which is IOC data exchange, as we can see in our browser. So as I was mentioning about looking around and checking out the instance, before you actually join, once you get to the homepage, you can kind of take a look around and see what the posts look like. You can see some stats about the server, this IOC that exchange has 17,000 active users, you can check out the Explorer option, local, they give a little explanation here, these are the most recent public posts from people whose accounts are hosted by IOC data exchange. So again, local to the instance that we are on currently, there is then the federated option. And these are the most recent public posts from people on this and other servers on the decentralized network that the server knows about. So let’s say that someone on IOC that exchange follows another user on a different federated server. And since someone on IOC that exchange is following someone on mastodon.rt, those two servers know about each other in the federated network, which is why you see posts from mastodon.rt on the federated page. And so as far as researching the instance that you want to sign up for goes, here, we have who it’s administered by, again, server stats, we can click learn more, we can kind of see some details about it, the server roles. And so since this is decentralized, and individuals are hosting these instances, you can see some details about the hosting. So here we have, it’s hosted in Linode. It’s costing them around $300 a month, where media files are hosted different details like that. So each of the servers here should have some sort of information like that. So if we take out, so we check out tech hub dot social. Again, we can see who it’s administered by 42,000 active users. Learn more, we can see details about it. So look through different servers, check out the local content, see if it’s things you’re interested in. There’s a lot of servers to choose from. So take your time and test them out. So for this example, like I said, I’m going to create an account on IOC that exchange. So create an account, just some ground rules, except, so your display name is what will show on your profile. So in my case, I’m just going to put side of burritos, your user name, this is going to be your handle on mastodon. So I’m just going to do side of burritos, enter your email address, password, agree and sign up. Select most online accounts, you need to go click the confirmation link that went to your email address. Once you click that, you’ll then be able to login.
So we’re back I just clicked the confirmation message in my email, we can see we’re presented with a page of individuals we can follow. Click the plus to follow people if you want. So we just followed these two individuals. So this is the home feed, we can see here the individuals that I followed a little bit earlier. On the left side here we have or we can write whatever we want and then publish it along with different options, add photos, who can view it different things like that. Bottom right, we have things that are trending on the right side notifications explorer local. So again, just explore click around you can see different things. There’s a couple things I want to cover on the actual profile page. So I’m going to go to my profile. This is not my actual profile. I just signed up with this for an example. So don’t try and follow this. And so what I want to note on this page, so if you used Twitter, you might have seen that you had a handle. Mine was outside of burritos, but on Mastodon there’s one extra part on here, which is the actual domain of the instance that we signed up for, in my case IOC data exchange. And the reason for this is that this username that I configured on IOC that exchange is unique to this instance. So if we go back to the mastodon servers page, someone could also go ahead and create an account, which is outside of burritos at Tech Hub dot social because user names are unique per instance on the mastodon network. So now what you might be thinking is well, that could lead to a lot of impersonations, or someone making a fake profile and a different instance and pretending to be you or, or me in this example. And that could definitely be a problem. And so that’s why I want to talk about how you can validate someone on Mastodon to make sure it’s the individual that you’re actually looking for. So my actual account where I am on Mastodon is at side of burritos at info, sec dot exchange. So we search for that we find my actual profile here, again, InfoSec. That exchange is the actual Mastodon instance that I signed up with. If you go to a profile on Mastodon and see a green box like this, that means the user validated, they own the domain or URL listed. The validation works by adding a small bit of code to the listed website that tells this Mastodon instance that my profile is associated with that domain, only someone that owns the actual domain they are claiming could add this code to it, which is why this works for validating domain ownership. So if you know someone is associated with a specific domain, and they validated it, this is a good indication that the profile is valid, and they are who they claim to be. You can validate domains under your profile settings. So in my case, I validated that I owned the site of burritos.com. I have my newsletter, if we go to those actual URLs, we can see that is indeed the actual site. So that’s just one way to validate someone is who they say they are. Another way to validate an account is to go to a site where you know, that individual already has an account. So in my case, there’s my Twitter page and my display name, I added my actual Mastodon account. So again, this is another way to validate my actual profile. So while this might sound a little bit confusing, at first, this is honestly just good practice to validate online profiles. Go to known good sources, such as Twitter, or YouTube channel, or someone’s individual website, and validate that actually claimed that they own a profile that you’re seeing for them, and it’s not someone impersonating them. Oh, and one more thing, while we’re on the topic of validation, if you see a checkmark or a blue checkmark on Mastodon, anyone can add those, it’s just a little icon, I added a burrito that does not have the same meaning as a checkmark on Twitter, not that checkmarks on Twitter mean much anymore. But just be careful if you see a blue checkmark on Mastodon, don’t assume that has any meaning behind it. And on the topic of getting set up, there’s a couple tools that exist that allow you to find your existing followers on Twitter that already have Mastodon accounts, the one I’ll be demonstrating with is deeper certify. Again, links will be down below in the description. And so what this does is connects to your Twitter account with Read Only permissions. And it’ll look through your followers or those you follow. And it’ll look for their account name, they might have listed on their profile. So in my case, I have it in my display name. It also searches for pin tweets, different things like that. And if it finds a mastodon account, it lets you export it, and then you can import that to your profile. So it’s an easier way to find people and kind of already get set up on the platform. So I’ll just run through an example. So authorized with Twitter, I’m going to authorize this app. So on an unrelated point to this video, always be careful authorizing apps don’t just authorize some random app to your account. As we can see here, it’s going to be able to see the tweets from your timeline that so can look through my pin tweet and see if I have an account listed there. It’s going to be able to see my profile information. And then it’s also going to be able to see those I follow mute and block someone to authorize app. I want to search followed accounts. We can see here that it searched 35 Twitter accounts. That’s how many accounts I’m following. It goes through which instances they are on. It’s all for mastodon. Here’s the details of those users. At the very bottom, I can download a CSV for export for Mastodon import. I’m going to do that. So now we’re going to go back to Mastodon where we created our account, we’re going to go into preferences. On the left hand side, import and export and go to import. The import type is following list. This is going to be people who I was following. I’m going to leave it set to the default of merge choose file. Following accounts. This is the CSV export from the Berta fi going to click Upload. Your data was successfully uploaded and will be processed in due time. If we go back to Mastodon I’m going to go to my profile. And we can now see that I’m following 12 accounts on mastodon. That’s how many accounts the Berta fi found out of the 35 individuals that I was following. So this is a quick way to import any of the accounts who were following on Twitter if those individuals added their profile information to their Twitter account. And since this is a popular tool, I would suggest that if you sign up for a mastodon account, add that to your display name on Twitter so that if someone else uses this tool to import their followers or those they’re following to their Mastodon account, they’ll be able to find you and start following you. So now that we signed up for an account, like most things, you might want to access that on your mobile device. So I want to walk through that and show you how to set that up. So once you open the app, we’re going to select login. And I think this is the part where most people get confused. So since we signed up on a specific instance, IOC that exchange, that’s the URL that we need to use inside the app to actually sign into our account, since that’s where our account exists. So I’m going to search for my server IOC dot exchange.
Here it is selected. Next, we’re taking the login page. So I’m going to sign in.
And so as long as you selected the correct instance, where you initially created your account, your email address and password will work for authentication, you’re going to see this page where you need to authorize the app with the ability to actually access your account. I’m going to allow it Authorize. And at this point, you’re in the app, you can post information, see your profile, see who you’re following everything like that. So if you have any difficulties, remember, you need to select the exact server that you signed up for an account on. If you don’t, your sign in will not work. So that’s Mastodon if you want to follow me or tag me in a post or slide into my DMs Feel free. So far, my experience has been positive. So I hope you have a similar experience after you sign up. I’m excited to see what the future holds. A big shake up on any platform is always kind of exciting leads to interesting times and whether the shake up leads to permanent platform changes or temporary ones. It’s still far too early to tell
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
On November 10 2022, I saw a tweet circulating from someone named David shifts that he had found a vulnerability to unlock any Google Pixel. He did a great write up on his blog, including the timeline when he disclosed it to Google explanation of how he found it and decode logic exploits, as well as a demonstration video, all of which I will link down below. The vulnerability exists in the way that the SIM card is unlocked on Android OS using the PUK code, which I will explain a little bit more later, I want to be clear that I have nothing to do with actually discovering this vulnerability. I’m just discussing what David shared publicly. And while I was debating and just talking about the video that he shared, it’s always a lot cooler to actually show something than just to talk about it, so I decided to test it out myself. To exploit this vulnerability, you need to have a SIM card with a pin which is easy enough anyone can set that through the settings and you also need a PUK code which is either written on the packaging that your SIM card comes in, or you need to call your carrier to get that information. The PUK code is used if you have a pin set on your SIM card and you forget it. Once you enter the PIN incorrectly three times you need to enter the PUK code to unlock it and to set a new pin. The easiest way to test this would be to use the SIM card I already have for my existing cell phone service. But it turns out that my carrier does not keep the PUC codes or does not give them out to users. If you lock yourself out of your SIM card, they just send you a new one. So that was not going to be an option. My next choice was to buy a prepaid SIM card and hope that it had the PUK code printed on the actual packaging. So the first prepaid SIM card I bought from Target since I had to go there anyways, I opened the packaging and there was no PUK code written on it. That means I would need to reach out to the carrier to get the PUK code. So I message them on Messenger through their website. I told them that I set a PIN code I forgot it and locked my sim before I was able to set up service. I asked them if I could get the PUK code to unlock it. They said absolutely we can sure do that for you. So I got pretty excited because usually things do not go so smoothly on a first try. And then the next message said we can give you the PUK code as soon as you sign up for service. After I pushed a few more times the representative kindly closed down the chat and I was out of luck. So I looked up where the nearest Best Buy was and I headed over there in the hopes that they would have a few more options. Thankfully, Best Buy did have more options. So I bought three different ones so I didn’t have to keep going back. I live in Florida, so I’m pretty sure that the cashier thought I was a dealer buying so many prepaid cards all at the same time. But regardless, I got to my car tore up in the packaging for the three SIM cards and none of them had the PUK code printed on it.
So when I got home, I checked and one of the three carriers had live chat available. So that’s the one I started with. I use the exact same story as earlier that I set a PIN code, I forgot it and I needed the PUK code so I could set up service. Thankfully, this time, the support individual was more than happy to give me the code. So we were all set the test. If you watch the recording that David released, it took him one attempt to actually get the screen to unlock on his device, which was a pixel six. For me, I was testing on a pixel six A where I intentionally flashed an out of date version of Android OS that had the October 2022 security patch, which means it was vulnerable to this exploit. And while it did end up working and unlocking my device, as you’ll see, it did take me about 10 minutes to actually get it to work. So the first thing I’m doing is failing the fingerprint authentication so that a PIN code is required so that I can show you that the phone is indeed locked. This is not required but make the demonstration a little more realistic. So the next step is to eject the SIM card slot on the device and then insert the SIM card that you set a PIN code on and that you know the PUK code for once you place that in the device, you’re going to get this screen asking for the sim pin. And what you want to do next is incorrectly enter the sim pin three times as fast forwarding this part because I’m adjusting my camera and then after you enter the sim PIN code and correctly three times you’re presented with this screen which is asking for the PUK code. You then enter the PUK code correctly, which lets you set a new pin. Once you do that, you’ll see the unlocking SIM card. And on the screen you might have seen it it was quick. But we saw the lock screen glitch and show us the Settings screen, which is the screen I have open currently on the pixel six A that I’m testing this on, this is the part that I didn’t see in David’s video, at least on the six A it took me multiple times as you’ll see, to actually get the lock screen to disappear. So I don’t know exactly what’s happening in the background that’s making this not unlock on the first time. But at this point I’m going to fast forward my next attempts so your eyes do not bleed from watching the same thing over and over again. And so while we wait for my unlock to be successful, let’s talk about exactly how this works. From what I understand at this time. This works because of a race condition that’s occurring in the sim unlock process. And don’t worry if you don’t completely understand my explanation the blog at LinkedIn the district Shouldn’t goes into more details if you want to read up on it. But on Android, there’s a concept of security screens when the fingerprint screen is displayed. That’s a security screen. When the pin on lock is displayed, that’s a security screen. These screens can also be layered on top of one another. So in this example, we have the PIN code security screen. And on top of that is the PUK code security screen. When the sim puck reset is successful, it issues a dismiss function, the dismiss function it calls does not specify which security screen is going to dismiss. So whichever security screen is active is the one that is dismissed. So what appears to be happening is that the puck reset is completing successfully, the puck reset is then calling the dismiss function. But something is changing in the background that’s making the PIN code security screen the active security screen instead of the puck code security screen. So therefore, instead of the puck security screen being dismissed, the PIN code security screen is dismissed and the phone is unlocked. And so we’re now back to normal speed because this is the attempt that unlocks my device. And there’s a couple things I want to point out that I noticed. So right after you enter the third sin pin incorrectly, the lock screen actually flashes and you can see the time there. That doesn’t happen on the previous attempts that were unsuccessful. The previous attempts would instantly show the PUK code the screen, and whenever that happened, the unlock was unsuccessful. So we can see here unlocking SIM card, and we now see the screen that was left open on my Pixel six A, the device is completely unlocked. We can swipe up see all the apps the device works as if we successfully unlocked it. So the main reason I made this video is to try and communicate that timely security updates matter vulnerabilities exist in all software just waiting to be discovered. And timely security updates are the only way that you can ensure that you’re protected quick updates might seem like a boring feature to look for in a mobile OS, but you need them. The fix for this is in the November 2022 security patch from Google to check if your Android device is patched, you can go into settings, about phone, tap on Android version, you can then look at the date for the Android security update. And if your phone isn’t up to date, update it.
If you’re using an OS with delayed updates, consider switching to another OS with faster updates. And if your phone is no longer supported with security updates, I guess this is more of an FYI. So that you understand the risk of using end of life hardware, you can’t have privacy without security. And this is just one example to show that. One example of an OS that still isn’t patched yet is lineage OS. I just installed this last night on a pixel five A. And as we can see, it’s still in the October 2022 security update, which means it is vulnerable. It’s also running android 12, which in my testing works every time you try this exploit. And as of the time of this recording, which is November 12 2022. I did confirm that graphene OS calyx, OS and stock Android OS are all up to date and are no longer vulnerable to this exploiting. The last thing I want to talk about is a feature on the OS that I recommend and use, which is Griffin OS. The feature is called Auto reboot. You can access this by going to your Settings Security, and selecting auto reboot. The option you select determines how long until your phone auto reboots after the last successful unlock. So in my case, if I don’t unlock my phone in a 12 hour time period, it reboots. Now, you might be asking yourself, Josh, how’s this supposed to help me if the lock screen can be bypassed. So it’s important to remember that if you just restarted your device, and you have not entered your PIN code successfully, at least once, then the user data on your device is still encrypted. And so while this exploit bypasses the lock screen, it has nothing to do with the encryption of your data. So as an example, I use this exploit after a reboot, and we can see the phone just hangs on pixels starting. The phone never gets past this point because the user data is still encrypted and safe. So let’s say that you were out somewhere in October, you lost your phone and someone found it. A few weeks later, it’s November, the individual that found your device came across this exploit and wants to see if they can get into your phone. So luckily, you had the auto reboot feature enabled 12 hours after the individual found your device and rebooted itself. And while they were able to get past the initial lock screen, since your device was not fully up to date, that individual was not able to actually get your data since it was still safe and encrypted. And so while this protection is imperfect, that does decrease the window of opportunity for the malicious actor.
So as far as the scope of this vulnerability goes, Daniel McKay covered that in a tweet. I’m paraphrasing what he shared, but this is an Android vulnerability, not something specifically related to the Google Pixel, depending on what a vendor altered in their fork of aos P. They may not be impacted by this, but if they use close to unaltered aos P will likely be impacted. And lastly, I want to mention that while this might seem like a basic oversight by a developer vulnerabilities like this exist in all code and will continue to be discovered, so keep your software up to date and do protection so keep your software up to date to make sure that you stay protected
]]>Please excuse any grammatical errors. I used a tool to generate the transcript and haven’t had a chance to read through it yet.
So the main purpose of today’s video is to install graphene OS on the Google Pixel six a specifically, the process will be similar regardless of which pixel you have. But the one I’m demonstrating on today is the six A, we’re going to be following the instructions on graphene os.org. I’ll put the link down below in the description as well as on the screen right now. And we will be using the web installer, it’s essentially impossible to break your phone using the web installer. So don’t be scared to try this, I’ve done the process probably about 50 to 100 times at this point, I’ve never had an issue with it. Now that being said, there are some issues that come up for some individuals when they are going through the install process. And I will point those out throughout the video for any tips, you can try to overcome those. But with that out of the way, let’s begin the installation process. So we’re at Griffin os.org, the web installer, we’re going to go down to the prerequisites, give this a read through the supported OS. I’m installing this from Mac OS today using brave browser, make sure you are using a supported browser and a supported OS. Otherwise you will encounter issues. This is a very important note for those on Ubuntu. If you’re using chromium that is broken and will not work. So make sure if you’re on a boon to you are not using chromium. So once you know you’re using a supported browser and OS, we can continue, make sure to give all this a read through I’m not going to waste your time reading it to you. But there’s some other important bits of information in here such as Do not use an incognito browser or private browser. Because again, you will encounter issues. So once you make sure all the prerequisites are met, we are on to enabling OEM unlocking. So just a note about where you get your information from always go to the source directly, in this case, Griffin os.org. That’s why I’m following along in their guide when showing you the developers do a great job documenting the installation process and different features. Always go to the source. First, don’t trust some random YouTuber talking about it, or some random forum posts that you saw, you’ll always get the best information directly from the source. So the first step for this OEM unlocking needs to be enabled from within the operating system, enable the developer options by going into settings about and pressing the build number entry until developer mode is enabled. So I’m going to be demonstrating this, like I just took my pixel out of the box. When you turn it on for the first time, you will see this screen. If you already past the initial setup, and you want to skip ahead, I’ll have that in the play bar below. So you can skip this section. But if you’re here, go ahead and press Get Started. I don’t have a SIM card in the phone yet. So go ahead and click Skip. So you could connect to Wi Fi at this point. But I like to skip this because we don’t need a Wi Fi connection, we can set up the pixel offline first. So we’re gonna go to Setup offline. Just a quick warning about setting up offline continue. Date and time. I uncheck these just for good practice. Except Except it’s always good practice to set a pin. Even if you’re just going to be erasing the OS quick. Sometimes I don’t but you should anyways.
No fingerprint, no thanks. Skip, and then swipe up to go home. So at this point, we’re on the home screen, the first step is to go into settings about so swipe up,
you’ll see settings, go to Settings, scroll down to the bottom, we’re going to go into about phone, scroll down at the bottom here you see build number. Now tap on that you will get this screen if you set a PIN number, type in the pin. And we can now see you are now a developer. So developer options are enabled. And that’s where the setting for OEM unlocking will be located. So next, go into settings, system developer options and toggle OEM unlocking. So we’re gonna go back word in the settings, so go to System developer options. And here’s the option to enable OEM unlocking. So there’s a couple things to note about OEM unlocking. So if you purchase your device brand new OEM unlocking will be grayed out and you won’t be able to enable it. The reason for that is that you need to actually connect to Wi Fi at this point before you can enable OEM unlocking. So we can see here OEM unlocking requires Internet access so that the stock OS can check if the device was sold as locked by a carrier. And so what does that actually mean? So the founder and lead developer of graphene OS has a thread on Twitter describing how OEM unlocking actually works, which again, I’ll link down below if you want to read through it. So essentially, how that works is that Google has a database of the pixels serial numbers and which ones were sold as an unlocked device not locked by the carrier. Your device will check with Google if the device is enabled for OEM unlocking after you connect to the internet. You will then be able to enable OEM unlocking. If your device checks with Google and your serial number is not authorized for unlocking, then that option will remain grayed out because it’s locked by the carrier devices that are commonly locked or Verizon branded pixels. So if you have a Verizon pixel, you will not be able to enable OEM unlocking and you cannot install graphene unless your only option is to return it or sell it and buy a OEM, unlockable pixel. For me personally, I buy my devices directly from Google as unlocked, so I know that it’s unlockable, I don’t need to worry about it being locked. If you decide to buy used online, I would suggest asking the seller to confirm if OEM unlocking is available, had them send you a screenshot so that you know, I’ve made the mistake in the past of buying a locked pixel, I had to return it. So don’t make the same mistake as me. One other note on the site is so for the pixel six A, this phone in particular, if you’re using one, unlocking won’t work with the version of the stock OS from the factory, you need to update it to the June 2022 release or later, via and over the air update. After you’ve updated it, you also need to factory reset the device to fix the OEM unlocking issue. So depending on when you bought your pixel, this may not be an issue for you. This pixel was purchased around a month ago, and it shipped with the newer updates. And I did not have to factory reset or follow this at all to get it to work. But if you purchased a pixel earlier, you may need to do this and follow these steps to actually get OEM unlocking to work. So I’ve unlocked this device in the past, which is why OEM unlocking is available. So again, connect to Wi Fi, if it’s not, if your device is able to be unlocked after a checksum with Google, you will then be able to enable it, enable OEM unlocking if you have a pin set you need to enter it. Allow OEM unlocking enable, and we can now see it’s enabled. So on to the next step flashing as non root. This is for Linux distributions, I’m not going to cover this part. So the next step is booting into the bootloader interface, you need to boot your phone into the bootloader interface. To do this, you need to hold the Volume Down button while the phone boots. The easiest approach is to reboot the phone and begin holding the Volume Down button until it boots up into the bootloader interface. So now what that looks like we have OEM unlocking enabled. Going to swipe down, going to pull down again, in the bottom right hand corner is the power button. And then from here, we’re going to select Restart, hold down the volume down button on the right side of the phone. So as you saw that took about 10 seconds. And once you see this screen, we are in the bootloader interface. If the screen doesn’t come up for you, the phone will just boot up like normal, try restarting and again, hold the Volume Down button until you get to this screen. So the next step is actually connecting the phone to our computer. And so for this step I want to mention, make sure you use the stock cable that actually came with your device. Now that being said, the most common issue that I’ve heard others talk about is that their computer doesn’t see the phone. And that’s because they have a faulty USB cable. So if you plug in your USB cable to your computer with your phone, and it doesn’t see it or you have any other strange issues when downloading the OS later in this guide, go ahead and try a different USB cable, and likely that’ll solve your issue. Also, when connecting the USB cable to your computer connected directly to your computer, don’t connect it through a dongle that’s plugged into another port. While it still might work. This could lead to some other strange issues. Let’s go ahead and connect the USB cable to our device. So just some notes here. If you’re using Windows on Windows, you need to install the driver for fastboot. If you don’t already have it, you can obtain the driver from Windows Update, which will detect it as an optional update when the device is booted into the bootloader interface and connected to the computer. So you should see a little pop up if you’re on Windows. Another method is to go here and just download the driver manually. But the easiest option will likely be through Windows Update. So once you have your device connected to your computer with a USB cable, and you have all the drivers installed, if you’re on Windows, the next step is unlocking the bootloader. It’s important to note that unlocking the bootloader will erase the device and wipe all data. It’s impossible to recover your data if you erase it. So make sure if you had any contacts or calendar events or photos that you need to save that you save those before proceeding because your device will be erased. So if you’re ready to continue, we’re going to press the unlock bootloader button, you’ll see this prompt in your browser. If you have issues or if the drivers didn’t install or you’re using an unsupported browser, you’ve likely will not see your phone here. If that’s the case, the first and easiest step, go through again, if you’re on Windows, make sure you install the drivers. And what I usually suggest to people is if you’re not using Google Chrome, just go ahead and install it even if it’s temporary google chrome Rome is supported and will work. So that’s one easy way to rule out that your browser is the issue. But if you do see it in your browser, and you see you can select your phone, go ahead and select Connect, you’re going to see this warning on the phone, take a second to read that through. Once you do, press the volume down or up button, so that it says unlock the bootloader. And once you see that, press the Power button to select that. And if this was successful, you will now see device state red unlocked, as compared to before where it was green and said locked. So once you see device state unlocked, we’re ready to proceed on to the next step. Next one is obtaining the factory images. So go ahead and press download release. This will download the release in your browser. Depending on your internet connection speed. This could take a minute, a few minutes or an hour. And so while that’s downloading it, just want to mention that once you start using graphene OS consider donating to the project. The developers put in a lot of hard work supporting current devices and new devices very quickly. The donations are used for paying developers and purchasing hardware. Me personally, I like the GitHub sponsors option. So I set that up. So I have a reoccurring monthly donation. And again, I’ll link this down below. So you can check out the page and set up your donation. And so once that finishes, you’ll see the progress bar is full and this will say downloaded and then the name of the release dot zip. And the next step is to actually flash the image to our device. So the initial install be performed by flashing the factory images. This will replace the existing OS installation and wipe all existing data. The main thing to note here is avoid interacting with the device until the flashing script is finished and the device is back at the bootloader interface. So once you’re ready, select flash release, you’ll see your screen change waiting bootloader. And your device will now flash and go through the entire process. And again, this will probably take five to 10 minutes. So while that’s flashing and you and I are both waiting for this to finish, I just want to mention that I have a monthly newsletter that I send out, you can sign up for that at side of burritos.com. So the other day I was talking to my best friend who was a truck driver and he asked me if I knew what frogs did when their car breaks down. I said no, I do not know what frogs do when their car breaks down. And he said they get it towed. So with that great joke out of the way I’m going to fast forward the video and I will see you shortly
so once that’s completed, for me, it took about five minutes for that to complete. You will see flashed and then again the name dot zip to device. And I want to the next step which is locking the bootloader which is extremely important as it enables full verified boot. And some of the reasons why this is extremely important are in the rest of this paragraph, which I would suggest you read over. So to do that, we’re going to select Lock bootloader again, we can see do not lock the bootloader use the volume up or down to change that. When it says lock the bootloader Press the Power button to select and once that is successful, you will see device state is now green locked. So once that’s completed, we can go on to the next step post installation booting. You’ve now successfully installed graphene OS congratulations and can boot it. pressing the power button with the default start option selected in the bootloader interface will boot the OS. So we can see here it says start press the power button the screen is normal. Do not be afraid if you see that we have a customer lesson installed. Seeing the Google screen is normal and then once you see the graphene OS screen, this is now the boot animation booting into graphene OS so the next step after booting is disable OEM unlocking. So for that we have to go to the initial setup. So start set your language, date and time set that we’re going to skip Wi Fi for now. I don’t have a SIM card if you do, you can put it in now just turn location services off by default. Next, I’m going to skip fingerprint setup but you can set that up if you want. I’m just going to set a PIN code quick just for the demo but again, set a secure PIN code along with fingerprint if you want. I don’t have a backup to restore from Skip and start. So we have now reached the GrapheneOS home screen. And now to disable OEM unlocking we’re gonna go into settings. We’re going to scroll down again to About phone. Go to the bottom tap Build Number or type in the PIN code. We can now see your now developer, go back system developer options.
Disable OEM unlocking, please restart the device to enabled device protection feature. And also, I’m going to disable developer options, you don’t really need those enabled,
we can now see developer options are gone. So as the instruction said, Let’s Reboot the device, since we disabled OEM unlocking, restart so I’m just gonna press the power button quick, so I can pause it on the screen. So the next part, verifying installation, give this a read over some very good information. This verified boot key hash, the reason I paused it by pressing the power button on boot is that we can verify the boot key hash. And here we have the pixel six A in this example, can make sure the number matches there. Which does so we’re good to go. So I’m gonna press the power button to resume. So I’m just gonna log in quick. So the next thing I want to cover quick is what I think is the best setup for anyone that’s new to Griffin OS. If you’ve read around, there’s a lot of videos, including my own channel or blog post that talks about using F Droid or Aurora store or all these different things you can do to increase your privacy and security. And while some of them are valid, it can be a bit overwhelming for anyone that’s new. So what I’m going to do is show you a basic initial setup that I think is best for anyone that’s new here. So for that we need to connect to Wi Fi.
And some other Wi Fi is connected, we can proceed on, we’re going to swipe up, we’re going to go into apps.
And the apps app support allows you to install different apps that are provided by Griffin OS. In this case, we’re going to be installing the sandbox Google Play services. Again, like I said, this is going to be a basic setup for anyone that’s new, I get a lot of messages from people that say they’re new to privacy or the security community. And it’s overwhelming at first they get a VPN, they get a new phone, they get this, they get that they want to use F droid. And I can understand how that’s overwhelming. And that’s why don’t suggest trying to do everything at first, privacy and security as a journey. You can’t do it all at once. Because if something’s too difficult, you’re not going to stick with it, you’re gonna give up easily. And that’s why I think it’s easier to go ahead and install the sandbox Play services use Google Play, like we’re about to do and start there. Once you get comfortable with the OS, you can make changes one by one, you can check out some other videos I have, you can see different suggestions that users might have online. But the first step is getting a solid base that you’re comfortable with using Griffin OS. And I think sandbox Google Play services are a great place to start. So to do that, we’re going to go down to the bottom, and we want to install Google Play Store. We can see here it’s going to install these other two dependencies, services framework and Play services. So select Install. All right. So that took about three minutes, we can now see that it’s finished. Because we see the Open option. You can either select open, or you can go swipe up. And you’ll now see Play stores installed. This is the same Play Store you’d get on Android OS except on graphene OS it’s sandboxed and installed as a normal app instead of an app with system level access. So select the Play store. You can select Sign In. And then at this point, you can either sign in with your personal Gmail account. Or another option if you want a little bit of increased privacy, create a separate gmail account that you can use specifically for this. That’s not tied to anything else you have. If you have paid for apps, you can sign in with that account. You can installed paid apps like anything else. And since we now have all the Google services installed in our device, notifications, and everything else will work as expected. And if you’ve used Android in the past, this is going to feel like the standard Android experience.
]]>This is where Tornado Cash is hosted on IPFS (InterPlanetary File System)
This URL will take you to the actual service. I’m linking it for reference if you’re curious.
hXXps://ipfs[.]io/ipns/tornadocash.eth/
https://twitter.com/tornadocash - Tornado Cash twitter account
]]>Don't have a Wi Fi network?cd /Volumes/KOBOeReader/.kobo/KoboReader.sqlite using sqlite3
sqlite3 KoboReader.sqlite
If you don’t have sqlite3 installed you can download it from -
https://www.sqlite.org/download.htmlINSERT INTO user(UserID,UserKey) VALUES('1','');..exit.Source: https://www.reddit.com/r/kobo/comments/mt2f30/how_to_bypass_account_setup/
On the boot screen, depending on where you purchased your device from you may see a random company logo (such as Walmart). The following will let you remove that branded logo.
.kobo folder..kobo folder, open the file named affiliate.conf.affiliate=walmart (or whatever company it says) to affiliate=kobo. Save and exit the file.Source: https://www.reddit.com/r/kobo/comments/igin1w/step_by_step_directions_for_removing_the_walmart/
Full Size Diagram from video -
To download a full-size copy of the image, Right-Click the Full Size Image link and select Save Link As (or just click it to view)
More From DuckDuckGoDuckDuckGo Desktop App β press Join waitlistFor some reason, I wasn’t able to get Firefox to send a blank header even with the Empty header mode enabled. Perhaps it’s something with the browser. As a workaround, enter a space in the Value box once you get to step 5. Click the Value box, and hit your space bar once. After that, everything should work as expected. If you know why it’s not working, please reach out.
ModHeader for your browser (links below)+ and click Request Header.Name box enter If-None-Match. Since we want to send an empty header, leave the Value box empty (Firefox users enter a space).Empty header mode.Send empty header option.Your configuration should look similar to this image
At this point your browser is now configured to send an empty If-None-Match HTTP Header. To test, visit the follow URL -
https://hinternesch.com/page1.html. If everything is working as expected, you should see Your ID is . if you see something else, then it’s not working as expected.
Privacy & Security on the left.Enhanced Tracking Protection select CustomCookies box, click the dropdown next to it, and select All third-party cookiesTracking content, Cryptominers, and Fingerprinters.Privacy and Security on the left.Cookies and other site dataGeneratl settings select the Block third-party cookies radio button.Safari in the top menu bar and select Preferences....Privacy tab.Website tracking: that says Prevent cross-site trackingCookies and site permissions on the left.Cookies and data stored click Manage and delete cookies and site data.Block third-party cookies.Settings on the bottomMy Apps section, select Repositories+ in the upper right cornerAddress listed on the page -
https://www.bromite.org/fdroidAddress you copied in the Repository address boxFingerprint of the signing keyFingerprint of the signing key in the Fingerprint boxBromite and install the appIf you’re on Arch Linux or Debian/Ubuntu, use the following commands to install as non-root:
sudo pacman -S android-udev
Arch Linux
sudo apt install android-sdk-platform-tools-common
Debian/Ubuntu
Full Size Image -
To download a full-size copy of the image, Right-Click the Full Size Image link and select Save Link As
cd Downloads
Change to the directory of the files we downloaded earlier β Link to section in video
dir
Show the contents of the directory β Link to section in video
CertUtil -hashfile device-flasher.exe SHA256
OPTIONAL β Verify device-flasher β Link to section in video
CertUtil -hashfile redfin-factory-202112110.zip SHA256
OPTIONAL β Verify CalyxOS image β Link to section in video
sudo apt update
Update local repositories β Link to section in video
sudo apt install android-sdk-platform-tools-common
Install required packages β Link to section in video
sudo apt install adb
Install Android Debug Bridge β Link to section in video
cd ~/Downloads
Change directory to where files were downloaded β Link to section in video
sha256sum device-flasher.linux
OPTIONAL β Verify device-flasher β Link to section in video
sha256sum redfin-factory-202112110.zip
OPTIONAL β Verify CalyxOS image β Link to section in video
chmod +x device-flasher.linux
Make device-flash executable β Link to section in video
./device-flasher.linux
Execute device-flasher.linux β Link to section in video
cd ~/Downloads/calyxos
Change Directory (if stored in your downloads folder). If you named the folder differently, then change βcalyxosβ to what you named it β Link to section in video
shasum -a 256 device-flasher.darwin
OPTIONAL β Verify device-flasher β Link to section in video
shasum -a 256 redfin-factory-number_in_file_name.zip
OPTIONAL β Verify CalyxOS image β Link to section in video
pwd
Print Working directory β Link to section in video
cd ~/Downloads/calyxos
Change to the directory of the files we downloaded earlier β Link to section in video
chmod +x device-flasher.darwin
Make device-flasher.darwin executable β Link to section in video
./device-flasher.darwin
Execute device-flasher.darwin β Link to section in video